docker-stable (SUSE:Linux Enterprise Module for Containers 15 SP6) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Containers 15 SP6 package docker-stable, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (55)

• CVE-2024-23652 — CVSS 10.0 (critical): BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit…
• CVE-2014-9357 — CVSS 10.0 (critical): Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in…
• CVE-2024-41110 — CVSS 9.9 (critical): Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain…
• CVE-2019-14271 — CVSS 9.8 (critical): In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility…
• CVE-2024-23653 — CVSS 9.8 (critical): BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to…
• CVE-2024-23651 — CVSS 8.7 (high): BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build…
• CVE-2014-9356 — CVSS 8.6 (high): Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection…
• CVE-2018-16873 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag…
• CVE-2018-16874 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path…
• CVE-2021-41103 — CVSS 7.8 (high): containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd…
• CVE-2015-3629 — CVSS 7.8 (high): Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to…
• CVE-2016-3697 — CVSS 7.8 (high): libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username…
• CVE-2025-22869 — CVSS 7.5 (high): SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key…
• CVE-2019-13509 — CVSS 7.5 (high): In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode…
• CVE-2016-8867 — CVSS 7.5 (high): Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user…
• CVE-2014-8179 — CVSS 7.5 (high): Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON…
• CVE-2023-28840 — CVSS 7.5 (high): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
• CVE-2021-43565 — CVSS 7.5 (high): The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
• CVE-2018-15664 — CVSS 7.5 (high): In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with…
• CVE-2025-22868 — CVSS 7.5 (high): An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
• CVE-2014-6407 — CVSS 7.5 (high): Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link…
• CVE-2014-3499 — CVSS 7.2 (high): Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via…
• CVE-2015-3627 — CVSS 7.2 (high): Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which…
• CVE-2015-3630 — CVSS 7.2 (high): Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs…
• CVE-2021-21284 — CVSS 6.8 (medium): In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root…
• CVE-2023-28842 — CVSS 6.8 (medium): Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2023-28841 — CVSS 6.8 (medium): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2017-14992 — CVSS 6.5 (medium): Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1…
• CVE-2025-22872 — CVSS 6.5 (medium): The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When…
• CVE-2021-21285 — CVSS 6.5 (medium): In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest…
• CVE-2014-9358 — CVSS 6.4 (medium): Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof…
• CVE-2016-9962 — CVSS 6.4 (medium): RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of…
• CVE-2021-41091 — CVSS 6.3 (medium): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the…
• CVE-2020-13401 — CVSS 6.0 (medium): An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6…
• CVE-2017-16539 — CVSS 5.9 (medium): The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows…
• CVE-2018-16875 — CVSS 5.9 (medium): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain…
• CVE-2022-24769 — CVSS 5.9 (medium): Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker…
• CVE-2024-29018 — CVSS 5.9 (medium): Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container…
• CVE-2020-12912 — CVSS 5.5 (medium): A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power…
• CVE-2014-8178 — CVSS 5.5 (medium): Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes…
• CVE-2020-8695 — CVSS 5.5 (medium): Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information…
• CVE-2020-8694 — CVSS 5.5 (medium): Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable…
• CVE-2021-41092 — CVSS 5.4 (medium): Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login…
• CVE-2024-23650 — CVSS 5.3 (medium): BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit…
• CVE-2018-10892 — CVSS 5.3 (medium): The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw…
• CVE-2022-36109 — CVSS 5.3 (medium): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where…
• CVE-2020-15257 — CVSS 5.2 (medium): containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions…
• CVE-2014-5277 — CVSS 5.0 (medium): Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows…
• CVE-2014-6408 — CVSS 5.0 (medium): Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container…
• CVE-2018-20699 — CVSS 4.9 (medium): Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a…
• CVE-2025-0495: Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets…
• CVE-2015-3631 — CVSS 3.6 (low): Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows…
• CVE-2021-41190 — CVSS 3.0 (low): The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI…
• CVE-2021-41089 — CVSS 2.8 (low): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where…