CVE-2014-6407: Arbitrary Code Execution in Docker
Summary
CVE-2014-6407: Arbitrary Code Execution in Docker. Affects github.com/docker/docker versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-6407 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides a lightweight and portable environment for running applications, isolating them from the underlying system. Docker is written in Go and is widely used in the software development industry.
Vulnerability Detail
The vulnerability identified as CVE-2014-6407 allows remote attackers to write to arbitrary files and execute arbitrary code in Docker versions before 1.3.2. This vulnerability can be exploited through a symlink or hard link attack in an image archive during a pull or load operation. By leveraging this vulnerability, an attacker can gain unauthorized access to the host system and execute malicious code, potentially leading to further compromise or data breaches.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading Docker to the recommended version.
Conclusion
The vulnerability CVE-2014-6407 in Docker poses a significant security risk, allowing remote attackers to execute arbitrary code and compromise the host system. It is crucial to upgrade Docker to version 1.3.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that enables developers to automate the deployment and management of applications within containers.
This vulnerability allows remote attackers to execute arbitrary code and gain unauthorized access to the host system, potentially leading to further compromise or data breaches.
To fix this vulnerability, upgrade Docker to version 1.3.2 or later, which includes the necessary patches and security enhancements.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading Docker.
For more information about this vulnerability, refer to the official CVE-2014-6407 advisory or contact the Docker support team.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
