CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27534
https://notcve.org/view.php?id=CVE-2020-27534
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. El archivo util/binfmt_misc/check.go en Builder en Docker Engine versiones anteriores a 9.03.9, llama a os.OpenFile con un nombre de ruta temporal qemu-check potencialmente inseguro, construido con un primer argumento vacío en una llamada de ioutil.TempDir. • http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes https://github.com/moby/buildkit/pull/1462 https://github.com/moby/moby/pull/40877 https://golang.org/pkg/io/ioutil/#TempDir https://golang.org/pkg/os/#TempDir • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5278
https://notcve.org/view.php?id=CVE-2014-5278
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs. Se presenta una vulnerabilidad en Docker versiones anteriores a 1.2, por medio de los nombres de los contenedores, que pueden colisionar y anular los ID de los contenedores. • https://github.com/xxg1413/docker-security/tree/master/CVE-2014-5278 https://groups.google.com/forum/#%21topic/docker-announce/lK6fQY6Jy84 https://groups.google.com/forum/message/raw?msg=docker-user/jyf9_mYcMI8/EIZfwe2QNzYJ •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0048
https://notcve.org/view.php?id=CVE-2014-0048
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. Se encontró un problema en Docker versiones anteriores a la versión 1.6.0. Algunos programas y scripts en Docker se descargan mediante HTTP y luego ejecutados o usados de manera no segura. • http://www.openwall.com/lists/oss-security/2015/03/24/18 http://www.openwall.com/lists/oss-security/2015/03/24/22 http://www.openwall.com/lists/oss-security/2015/03/24/23 https://access.redhat.com/security/cve/cve-2014-0048 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0048 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0048 https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E https://security&# • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8179
https://notcve.org/view.php?id=CVE-2014-8179
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. Docker Engine versiones anteriores a la versión 1.8.3 y CS Docker Engine versiones anteriores a la versión 1.6.2-CS7 no comprueba y extrae apropiadamente el objeto manifiesto desde su representación JSON durante una extracción, lo que permite a atacantes inyectar nuevos atributos en un objeto JSON y omitir la comprobación pull-by-digest. • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7 https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12 https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ https://www.docker.com/legal/docker-cve-database • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8178
https://notcve.org/view.php?id=CVE-2014-8178
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands. Docker Engine versiones anteriores a la versión 1.8.3 y CS Docker Engine versiones anteriores a la versión 1.6.2-CS7, no utilizan un identificador único de forma global para almacenar capas de imágenes, lo que facilita a atacantes envenenar la caché de imágenes por medio de una imagen especialmente diseñada en los comandos pull o push. • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12 https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ https://www.docker.com/legal/docker-cve-database • CWE-20: Improper Input Validation •