Vulnerability CVE-2014-8737


Published: 2014-12-09   Modified: 2017-06-30

Description:
Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

Vendor: Fedoraproject
Product: Fedora 
Version:
21
20
19
Vendor: GNU
Product: Binutils 
Version: 2.24;
Vendor: Canonical
Product: Ubuntu linux 
Version:
14.10
14.04
12.04
10.04

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.6/10
4.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145352.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145746.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:029
http://www.openwall.com/lists/oss-security/2014/11/13/1
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/70908
http://www.ubuntu.com/usn/USN-2496-1
https://bugzilla.redhat.com/show_bug.cgi?id=1162655
https://security.gentoo.org/glsa/201612-24
https://sourceware.org/bugzilla/show_bug.cgi?id=17533
https://sourceware.org/bugzilla/show_bug.cgi?id=17552
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=dd9b91de2149ee81d47f708e7b0bbf57da10ad42

Related CVE
CVE-2017-13088
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to repl...
CVE-2017-13084
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVE-2017-13086
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVE-2017-13087
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames f...
CVE-2017-13082
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, ...
CVE-2017-13080
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
CVE-2017-13081
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
CVE-2017-13079
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.

Copyright 2017, cxsecurity.com

 

Back to Top