[Bug 1162655] New: binutils: directory traversal vulnerability

List overview All Threads
Download

newer

older

[Bug 1162666] New: binutils: out...

[Bug 1162621] New: CVE-2014-8504...

Red Hat Bugzilla

11 Nov 2014 11 Nov '14

1:46 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Bug ID: 1162655 Summary: binutils: directory traversal vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: bgollahe@redhat.com, dan@danny.cz, dhowells@redhat.com, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, jakub@redhat.com, kalevlember@gmail.com, kanderso@redhat.com, ktietz@redhat.com, law@redhat.com, lkocman@redhat.com, lkundrak@v3.sk, mfranc@redhat.com, mhlavink@redhat.com, nickc@redhat.com, ohudlick@redhat.com, pfrankli@redhat.com, rjones@redhat.com, rob@robspanton.com, seceng-idm-qe-list@redhat.com, swhiteho@redhat.com, thibault.north@gmail.com, tmlcoch@redhat.com, trond.danielsen@gmail.com

Directory traversal vulnerability allowing random files deleteion/creation was reported [1] in binutils. Upstream patch is in [2].

[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17552 [2]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=dd9b91de2149ee81d...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bEUzAveurp&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

11 Nov 11 Nov

1:46 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1156276

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=g6u4UNU2K4&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created mingw-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162660] Affects: epel-all [bug 1162665]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1162656 [Bug 1162656] arm-none-eabi-binutils-cs: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162657 [Bug 1162657] avr-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162658 [Bug 1162658] binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162659 [Bug 1162659] cross-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162660 [Bug 1162660] mingw-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162661 [Bug 1162661] msp430-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162662 [Bug 1162662] avr-binutils: binutils: directory traversal vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162664 [Bug 1162664] cross-binutils: binutils: directory traversal vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162665 [Bug 1162665] mingw-binutils: binutils: directory traversal vulnerability [epel-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Na0aLoZFyj&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created avr-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162657] Affects: epel-all [bug 1162662]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1176PQQduM&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #3 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created arm-none-eabi-binutils-cs tracking bugs for this issue:

Affects: fedora-all [bug 1162656]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6GHBLt5FIc&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #4 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created msp430-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162661]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qduVZLwWsU&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #5 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created cross-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162659] Affects: epel-all [bug 1162664]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CoqBJDRBRy&a=cc_unsubscribe

Red Hat Bugzilla

1:48 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #6 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162658]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ypBsTZIdBC&a=cc_unsubscribe

Red Hat Bugzilla

10:07 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #8 from Nick Clifton nickc@redhat.com --- Created attachment 956421 --> https://bugzilla.redhat.com/attachment.cgi?id=956421&action=edit Proposed patch

Hi Jeff, Hi Patsy,

I have uploaded a specially crafted patch that combines both of the fixes for PR 17552, built against the RHEL 7.1 sources. I hope that this helps.

Cheers Nick

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=jyzNzjEgsZ&a=cc_unsubscribe

Red Hat Bugzilla

12 Nov 12 Nov

11:09 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #9 from Jeff Law law@redhat.com --- Thanks Nick. I'm watching this very closely as we have a small window where we can fix this for RHEL 7.1. However, right now, this stuff is not slated for 7.1 by nature of no RHEL BZs from the security team, which is probably an artifact of these being marked as med/med or lower from an security standpoint.

My preference is to fix this and the controlled write in the BFD ELF code for RHEL 7.1 and RHEL 6.7. I do _not_ want to issue z-streams for these issues if we can avoid it.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nEOFP0iXBl&a=cc_unsubscribe

Red Hat Bugzilla

13 Nov 13 Nov

3:36 p.m.

New subject: [Bug 1162655] binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2014-8737

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=n6i7x99Dtf&a=cc_unsubscribe

Red Hat Bugzilla

3:36 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qmRFWrzCaQ&a=cc_unsubscribe

Red Hat Bugzilla

26 Nov 26 Nov

4:08 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Comment #10 from Vasyl Kaigorodov vkaigoro@redhat.com --- Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZeKTVyoW2u&a=cc_unsubscribe

Red Hat Bugzilla

4:13 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |binutils 2.25

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ROLy9WQhOZ&a=cc_unsubscribe

Red Hat Bugzilla

4:54 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168281

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=KVdbA3rQn8&a=cc_unsubscribe

Red Hat Bugzilla

4:55 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168302

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7AniKcg8Rf&a=cc_unsubscribe

Red Hat Bugzilla

27 Nov 27 Nov

10:14 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=EPMfHHywAO&a=cc_unsubscribe

Red Hat Bugzilla

3:38 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=43TqYeEVsO&a=cc_unsubscribe

Red Hat Bugzilla

6 Dec 6 Dec

3:35 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162656, which changed state.

Bug 1162656 Summary: arm-none-eabi-binutils-cs: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162656

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=19pSLHaaDX&a=cc_unsubscribe

Red Hat Bugzilla

3:36 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #12 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vQfij7RMWZ&a=cc_unsubscribe

Red Hat Bugzilla

3:39 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162657, which changed state.

Bug 1162657 Summary: avr-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162657

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tOvgV4wsEo&a=cc_unsubscribe

Red Hat Bugzilla

3:40 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #13 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=uYN0a1PRTW&a=cc_unsubscribe

Red Hat Bugzilla

11:03 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #14 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aUtYT0CnI8&a=cc_unsubscribe

Red Hat Bugzilla

11:08 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #15 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=roqAjQE2mE&a=cc_unsubscribe

Red Hat Bugzilla

7 Dec 7 Dec

5:37 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #16 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1rr6cpjfeG&a=cc_unsubscribe

Red Hat Bugzilla

5:39 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #17 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6UMaVNwGY4&a=cc_unsubscribe

Red Hat Bugzilla

10 Dec 10 Dec

4:29 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1172710

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Kl4wH6RR7I&a=cc_unsubscribe

Red Hat Bugzilla

2 Jan 2 Jan

6:06 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162660, which changed state.

Bug 1162660 Summary: mingw-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162660

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=obkMrDXDLI&a=cc_unsubscribe

Red Hat Bugzilla

9 Jan 9 Jan

4 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162665, which changed state.

Bug 1162665 Summary: mingw-binutils: binutils: directory traversal vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162665

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AM1ev30X4Q&a=cc_unsubscribe

Red Hat Bugzilla

22 Jan 22 Jan

12:07 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #19 from Fedora Update System updates@fedoraproject.org --- binutils-2.24-30.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=22VUfNMLP2&a=cc_unsubscribe

Red Hat Bugzilla

24 Mar 24 Mar

7:53 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162659, which changed state.

Bug 1162659 Summary: cross-binutils: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162659

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=2T7FNGNTHU&a=cc_unsubscribe

Red Hat Bugzilla

13 May 13 May

12:05 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #20 from Vasyl Kaigorodov vkaigoro@redhat.com --- Reproducer is available in https://sourceware.org/bugzilla/show_bug.cgi?id=17552#c0

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7oo42yBIxj&a=cc_unsubscribe

Red Hat Bugzilla

12:22 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Uuq7gSbIjr&a=cc_unsubscribe

Red Hat Bugzilla

12:54 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9rn4pnyfzJ&a=cc_unsubscribe

Red Hat Bugzilla

18 May 18 May

1:25 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Doc Text *updated* by Vasyl Kaigorodov vkaigoro@redhat.com --- A directory traversal flaw was found in strip and objcopy utilities. If a user were tricked into running strip or objdump on a specially crafted file, it could cause random files deletion or random files creation with the permissions of the user running application.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JABtC9HKvx&a=cc_unsubscribe

Red Hat Bugzilla

26 May 26 May

10:58 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A directory traversal flaw was found in the strip and objcopy utilities. A specially crafted file could cause strip or objdump to overwrite an arbitrary file writable by the user running either of these utilities.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=OmHTAmfKIf&a=cc_unsubscribe

Red Hat Bugzilla

9 Jun 9 Jun

4:19 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655 Bug 1162655 depends on bug 1162658, which changed state.

Bug 1162658 Summary: binutils: directory traversal vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162658

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lIAaxMIoUH&a=cc_unsubscribe

Red Hat Bugzilla

29 Jun 29 Jun

4:42 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Nick Clifton nickc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NWXkxWBoUV&a=cc_unsubscribe

Red Hat Bugzilla

2 Jul 2 Jul

12:54 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=J2pQPYYzfX&a=cc_unsubscribe

Red Hat Bugzilla

6 Aug 6 Aug

2:53 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Miloš Prchlík mprchlik@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |mprchlik@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9gLzPIsxyx&a=cc_unsubscribe

Red Hat Bugzilla

30 Sep 30 Sep

8:15 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1210268

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wA2xqetqPv&a=cc_unsubscribe

Red Hat Bugzilla

8:22 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=X73IBHCcn5&a=cc_unsubscribe

Red Hat Bugzilla

1 Oct 1 Oct

3:50 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HkebfvpSmy&a=cc_unsubscribe

Red Hat Bugzilla

16 Oct 16 Oct

5:08 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #22 from Nick Clifton nickc@redhat.com --- Created attachment 1083729 --> https://bugzilla.redhat.com/attachment.cgi?id=1083729&action=edit Remove resource leak from binutils-th1162655.patch

Note - the patch for this BZ inadvertently introduced a resource leak into the binutils sources. This leak is detected by the covscan tool.

What can happen is that a buffer of 8192 bytes is allocated but not freed. This only happens when an illegal archive is being processed, and in this case the program will exit very shortly afterwards. So the resource will not prevent the proper functioning of the program on valid archives, and it will not prevent the program from reporting and exiting (cleanly) on invalid archives.

Since this problem has been detected so late in the 7.2 release process, a fix for it is being delayed until 7.3. The update to fix the patch is uploaded here.

Cheers Nick

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=UCnD6nzmcs&a=cc_unsubscribe

Red Hat Bugzilla

19 Oct 19 Oct

7:25 p.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #23 from Jeff Law law@redhat.com --- Makes sense to me.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=va1Bwi1SF6&a=cc_unsubscribe

Red Hat Bugzilla

19 Nov 19 Nov

4:33 a.m.

New subject: [Bug 1162655] CVE-2014-8737 binutils: directory traversal vulnerability

https://bugzilla.redhat.com/show_bug.cgi?id=1162655

--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2015:2079 https://rhn.redhat.com/errata/RHSA-2015-2079.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=U0HkALbU1Y&a=cc_unsubscribe

3219

Age (days ago)

3592

Last active (days ago)

mingw@lists.fedoraproject.org

45 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla