CVE-2014-8737

2014-12-0923:59:07

CWE-22

[email protected]

web.nvd.nist.gov

cve-2014-8737

directory traversal

gnu binutils

vulnerability

local users

arbitrary files

nvd

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

8.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.2%

JSON

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a … (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a … (dot dot) or full path name in an archive to ar.

Affected configurations

NVD

Node

canonicalubuntu_linuxMatch10.04lts

canonicalubuntu_linuxMatch12.04lts

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch14.10

Node

gnubinutilsRange≤2.24

Node

fedoraprojectfedoraMatch19

fedoraprojectfedoraMatch20

fedoraprojectfedoraMatch21

CPENameOperatorVersion
canonical:ubuntu_linuxcanonical ubuntu linuxeq10.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.10

CPE	Name	Operator	Version
canonical:ubuntu_linux	canonical ubuntu linux	eq	10.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.10