CVE-2014-8737: Path Traversal
Directory traversal vulnerability allowing random files deleteion/creation was reported [1] in binutils. Upstream patch is in [2]. Reproducer is available in https://sourceware.org/bugzilla/showbug.cgi?id=17552#c0
[1]: https://sourceware.org/bugzilla/showbug.cgi?id=17552 [2]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=dd9b91de2149ee81d47f708e7b0bbf57da10ad42
Other sources
Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2014-8737.
What is the severity level of CVE-2014-8737?
CVE-2014-8737 has a severity level of medium.
What is the affected software?
The affected software is GNU binutils version 2.24 and earlier.
How can local users exploit this vulnerability?
Local users can delete arbitrary files or create arbitrary files by using directory traversal techniques in GNU binutils.
Where can I find more information about CVE-2014-8737?
You can find more information about CVE-2014-8737 at the following references: [Link 1](http://www.openwall.com/lists/oss-security/2014/11/13/1), [Link 2](https://bugzilla.redhat.com/show_bug.cgi?id=1162655), [Link 3](https://sourceware.org/bugzilla/show_bug.cgi?id=17533).