Docker
Page 2 of 2 — Docker CVEs from a corpus of 133, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-8178 | Medium | 5.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attac… |
CVE-2014-9356 | High | 8.6 | 2019-12-02 | Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full… |
CVE-2019-16884 | High | 7.5 | 2019-09-25 | runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorr… |
CVE-2019-15752 | High | 7.8 | 2019-08-28 | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMD… |
CVE-2019-13139 | High | 8.4 | 2019-08-22 | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command e… |
CVE-2019-14271 | Critical | 9.8 | 2019-07-29 | In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library… |
CVE-2019-1020014 | Medium | 5.5 | 2019-07-29 | docker-credential-helpers before 0.6.3 has a double free in the List functions. |
CVE-2019-13509 | High | 7.5 | 2019-07-18 | In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add sec… |
CVE-2018-15664 | High | 7.5 | 2019-05-23 | In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving… |
CVE-2019-5736 | High | 8.6 | 2019-02-11 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host roo… |
CVE-2018-20699 | Medium | 4.9 | 2019-01-12 | Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus v… |
CVE-2018-15514 | High | 8.8 | 2018-09-01 | HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\docker… |
CVE-2018-10892 | Medium | 5.3 | 2018-07-06 | The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to m… |
CVE-2015-9259 | Critical | 9.8 | 2018-03-31 | In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does… |
CVE-2015-9258 | High | 7.5 | 2018-03-31 | In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifyi… |
CVE-2014-5282 | High | 8.1 | 2018-02-06 | Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via… |
CVE-2017-14992 | Medium | 6.5 | 2017-11-01 | Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and ea… |
CVE-2014-0047 | High | 7.8 | 2017-10-06 | Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage. |
CVE-2017-11468 | High | 7.5 | 2017-07-20 | Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cau… |
CVE-2016-9962 | Medium | 6.4 | 2017-01-31 | RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if r… |
CVE-2016-6595 | Medium | 6.5 | 2017-01-04 | The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a long sequence of join… |
CVE-2016-8867 | High | 7.5 | 2016-10-28 | Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access fi… |
CVE-2016-3697 | High | 7.8 | 2016-06-01 | libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local us… |
CVE-2015-3631 | | 2015-05-18 | Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override… | |
CVE-2015-3630 | | 2015-05-18 | Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local use… | |
CVE-2015-3629 | High | 7.8 | 2015-05-18 | Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the hos… |
CVE-2015-3627 | | 2015-05-18 | Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gai… | |
CVE-2014-9358 | | 2014-12-16 | Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted… | |
CVE-2014-9357 | | 2014-12-16 | Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archi… | |
CVE-2014-6408 | | 2014-12-12 | Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecif… | |
CVE-2014-6407 | | 2014-12-12 | Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archiv… | |
CVE-2014-5277 | | 2014-11-17 | Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to c… | |
CVE-2014-3499 | | 2014-07-11 | Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors. |