CVE-2014-9447

2015-01-0200:00:00

ubuntu.com

0.009 Low

EPSS

Percentile

83.2%

JSON

Directory traversal vulnerability in the read_long_names function in
libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to
write to arbitrary files to the root directory via a / (slash) in a crafted
archive, as demonstrated using the ar program.

Bugs

<https://launchpad.net/bugs/1414206>

Notes

Author	Note
tyhicks	Directory traversal is restricted to the root directory

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchelfutils< 0.143-1ubuntu0.1UNKNOWN
ubuntu12.04noarchelfutils< 0.152-1ubuntu3.1UNKNOWN
ubuntu14.04noarchelfutils< 0.158-0ubuntu5.2UNKNOWN
ubuntu14.10noarchelfutils< 0.160-0ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	elfutils	< 0.143-1ubuntu0.1	UNKNOWN
ubuntu	12.04	noarch	elfutils	< 0.152-1ubuntu3.1	UNKNOWN
ubuntu	14.04	noarch	elfutils	< 0.158-0ubuntu5.2	UNKNOWN
ubuntu	14.10	noarch	elfutils	< 0.160-0ubuntu2.1	UNKNOWN