CVE-2014-8737: canonical ubuntu_linux Path Traversal

CVSS: 3.6v2.0LowModified

AliasesUBUNTU-CVE-2014-8737DEBIAN-CVE-2014-8737

Published 09-12-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-8737 is a low (CVSS 3.6) Path Traversal vulnerability in canonical ubuntu_linux. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

3.6/10

010

Low · v2.0 (NVD)

EPSS score

1.04%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

DLA-184-1 DSA-3123-1 DSA-3123-2 MGASA-2015-0027 RHSA-2015:2079 USN-2496-1

Timeline

09-12-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

CVSS metrics

1 score · 1 source · 1 version

v2.03.6

EPSS trend

Probability

1.04%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.04% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.04%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (sourceware.org)
Maturity: unknown
referenceUnverified
Exploit Reference (sourceware.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Debian2 products

binutils< 2.24.90.20141124-1
binutils-mingw-w64< 5.2

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Fedoraproject1 product

fedoraEOL19 | 20 | 21

Gnu1 product

binutils≤ 2.24

Ubuntu1 product

binutils< 2.24-5ubuntu3.1

5 vendors · 6 products

References

23 links

lists.fedoraproject.org/pipermail/package-announce/2014-December/145746.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/62241Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2015:029Vendor AdvisoryX Refsource MANDRIVABroken Link
bugzilla.redhat.com/show_bug.cgi?id=1162655X Refsource CONFIRMIssue Tracking
lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.ubuntu.com/usn/USN-2496-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
sourceware.org/bugzilla/show_bug.cgi?id=17552X Refsource CONFIRMExploitIssue Tracking
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145352.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory

Show all 23 references

www.openwall.com/lists/oss-security/2014/11/13/1Mailing ListX Refsource MLISTThird Party Advisory
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dd9b91de2149ee81d47f708e7b0bbf57da10ad42X Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/62746Third Party AdvisoryX Refsource SECUNIA
lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securityfocus.com/bid/70908VDB EntryX Refsource BIDThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
sourceware.org/bugzilla/show_bug.cgi?id=17533X Refsource CONFIRMExploitIssue Tracking
security.gentoo.org/glsa/201612-24Vendor AdvisoryX Refsource GENTOO
ubuntu.com/security/CVE-2014-8737REPORT
ubuntu.com/security/notices/USN-2496-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8737REPORT
security-tracker.debian.org/tracker/CVE-2014-8737Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities