Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Docker | Docker | 1.3.2 (including) | 1.3.2 (including) |
| Red Hat Enterprise Linux 7 Extras | RedHat | docker-0:1.4.1-37.el7 | * |
| Docker.io | Ubuntu | upstream | * |