Summary
Alexander Cherepanov discovered that libelf1 incorrectly handled certain
filesystem paths while extracting ar archives. An attacker could use this flaw
to perform a directory traversal attack on the root directory if the process
extracting the ar archive has write access to the root directory.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | elfutils | 0.158-0ubuntu5.2 |
Vulnerabilities 1
-
Unscored —
Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 all…
References
-
report
https://ubuntu.com/security/CVE-2014-9447