Bug 1178888 – CVE-2014-9447 elfutils: directory traversal in read_long_names()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1178888 - (CVE-2014-9447) CVE-2014-9447 elfutils: directory traversal in read_long_names()

Summary:	CVE-2014-9447 elfutils: directory traversal in read_long_names()

Status:	CLOSED ERRATA

Aliases:	CVE-2014-9447

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20141227,reported=2...
Keywords:	Security

Depends On:	1181525
Blocks:	1171146
	Show dependency tree / graph

Reported:	2015-01-05 10:26 EST by Vasyl Kaigorodov
Modified:	2017-06-30 07:52 EDT (History)
CC List:	17 users (show)

See Also:
Fixed In Version:	elfutils 0.162
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-06-30 07:52:04 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Vasyl Kaigorodov 2015-01-05 10:26:15 EST

Directory traversal vulnerability was reported in elfutils [1] 'ar' utility.
Upstream commit with the analysis:
https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e

[1]: https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html

Comment 1 Florian Weimer 2015-01-13 05:44:41 EST

Created elfutils tracking bugs for this issue:

Affects: fedora-all [bug 1181525]

Comment 2 Fedora Update System 2015-01-18 20:35:27 EST

elfutils-0.161-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2015-01-20 15:59:37 EST

elfutils-0.161-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Stefan Cornelius 2017-06-30 07:52:04 EDT

Fixed in RHEL6 via RHEA-2015:1302.

Fixed in RHEL7 via RHEA-2015:2126.

Note You need to log in before you can comment on or make changes to this bug.