{"id":"CVE-2014-6407","title":"Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.","summary":"Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.","severity":"high","cvss":7.5,"cvssVector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","cwe":["CWE-59"],"vendor":"docker","product":"docker","affected":["docker <= 1.3.1","docker = 1.0.0","docker = 1.3.0"],"published":"2014-12-12","updated":"2026-06-17","sourceUpdated":"2026-06-17T00:13:01.483","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2014-6407","references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html","label":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60171","label":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60241","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2014/11/24/5","label":"cve@mitre.org"},{"url":"https://docs.docker.com/v1.3/release-notes/","label":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/60171","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/60241","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2014/11/24/5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.docker.com/v1.3/release-notes/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-14T14:14:13.819Z","epss":0.04909,"epssPercentile":0.9206,"slug":"CVE-2014-6407","body":"## Overview\n\nDocker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.\n\n## Affected\n\n- `docker <= 1.3.1`\n- `docker = 1.0.0`\n- `docker = 1.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[{"seq":230259,"id":"CVE-2014-6407","ts":1793130866977,"field":"cvss","old":"7.3","new":"7.5"},{"seq":230255,"id":"CVE-2014-6407","ts":1793130850043,"field":"cvss","old":"7.5","new":"7.3"},{"seq":230228,"id":"CVE-2014-6407","ts":1793128618395,"field":"cvss","old":"7.3","new":"7.5"},{"seq":230215,"id":"CVE-2014-6407","ts":1793127869863,"field":"cvss","old":"7.5","new":"7.3"},{"seq":230203,"id":"CVE-2014-6407","ts":1793127716158,"field":"cvss","old":"7.3","new":"7.5"},{"seq":230147,"id":"CVE-2014-6407","ts":1793127231641,"field":"cvss","old":"7.5","new":"7.3"},{"seq":230139,"id":"CVE-2014-6407","ts":1793127113713,"field":"cvss","old":"7.3","new":"7.5"},{"seq":230135,"id":"CVE-2014-6407","ts":1793126054939,"field":"cvss","old":"7.5","new":"7.3"},{"seq":230131,"id":"CVE-2014-6407","ts":1793125981114,"field":"cvss","old":"7.3","new":"7.5"},{"seq":230127,"id":"CVE-2014-6407","ts":1793125828199,"field":"cvss","old":"7.5","new":"7.3"},{"seq":230122,"id":"CVE-2014-6407","ts":1793124933469,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229986,"id":"CVE-2014-6407","ts":1793124727443,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229982,"id":"CVE-2014-6407","ts":1793124328892,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229978,"id":"CVE-2014-6407","ts":1793124295010,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229972,"id":"CVE-2014-6407","ts":1793123670878,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229968,"id":"CVE-2014-6407","ts":1793123667118,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229964,"id":"CVE-2014-6407","ts":1793122631455,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229960,"id":"CVE-2014-6407","ts":1793122452025,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229954,"id":"CVE-2014-6407","ts":1793122401502,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229951,"id":"CVE-2014-6407","ts":1793120672519,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229926,"id":"CVE-2014-6407","ts":1793119349506,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229923,"id":"CVE-2014-6407","ts":1793119203567,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229919,"id":"CVE-2014-6407","ts":1793118847309,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229913,"id":"CVE-2014-6407","ts":1793118750309,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229904,"id":"CVE-2014-6407","ts":1793118007247,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229837,"id":"CVE-2014-6407","ts":1793117521888,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229834,"id":"CVE-2014-6407","ts":1793117516134,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229830,"id":"CVE-2014-6407","ts":1793117491150,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229810,"id":"CVE-2014-6407","ts":1793077280761,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229802,"id":"CVE-2014-6407","ts":1793056762565,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229793,"id":"CVE-2014-6407","ts":1793049236418,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229757,"id":"CVE-2014-6407","ts":1793047179948,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229753,"id":"CVE-2014-6407","ts":1793045627124,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229741,"id":"CVE-2014-6407","ts":1793043478460,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229737,"id":"CVE-2014-6407","ts":1793042016945,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229716,"id":"CVE-2014-6407","ts":1793039748769,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229712,"id":"CVE-2014-6407","ts":1793038403759,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229665,"id":"CVE-2014-6407","ts":1793036010443,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229661,"id":"CVE-2014-6407","ts":1793034793769,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229621,"id":"CVE-2014-6407","ts":1793032297168,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229617,"id":"CVE-2014-6407","ts":1793031180145,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229595,"id":"CVE-2014-6407","ts":1793028567787,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229591,"id":"CVE-2014-6407","ts":1793027567849,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229571,"id":"CVE-2014-6407","ts":1793024849175,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229567,"id":"CVE-2014-6407","ts":1793023954008,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229563,"id":"CVE-2014-6407","ts":1793021232397,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229559,"id":"CVE-2014-6407","ts":1793020344763,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229277,"id":"CVE-2014-6407","ts":1793019611748,"field":"cvss","old":"7.5","new":"7.3"},{"seq":229273,"id":"CVE-2014-6407","ts":1793017575939,"field":"cvss","old":"7.3","new":"7.5"},{"seq":229269,"id":"CVE-2014-6407","ts":1793016735312,"field":"cvss","old":"7.5","new":"7.3"}]}