USN-2482-1: elfutils vulnerability

Releases

• Ubuntu 14.10
• Ubuntu 14.04 ESM
• Ubuntu 12.04
• Ubuntu 10.04

Packages

• elfutils - collection of utilities to handle ELF objects

Details

Alexander Cherepanov discovered that libelf1 incorrectly handled certain
filesystem paths while extracting ar archives. An attacker could use this flaw
to perform a directory traversal attack on the root directory if the process
extracting the ar archive has write access to the root directory.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10

• libelf1 - 0.160-0ubuntu2.1

Ubuntu 14.04

• libelf1 - 0.158-0ubuntu5.2

Ubuntu 12.04

• libelf1 - 0.152-1ubuntu3.1

Ubuntu 10.04

• libelf1 - 0.143-1ubuntu0.1

After a standard system update you need to restart applications using libelf1
to make all the necessary changes.

References

• CVE-2014-9447