← Vulnerability feed

Vulnerability record · CVE-2014-9447 · published 2 January 2015

CVE-2014-9447: Elfutils project elfutils path traversal vulnerability

Elfutils Project · Elfutils

Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.

6.4 CVSS 2.0 Medium EPSS 5.0% · top 8.0% CWE-22 · Path traversal
6.4CVSS 2.0 base score
5.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
22References
17 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.

AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://advisories.mageia.org/MGASA-2015-0033.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html
http://secunia.com/advisories/61934
http://secunia.com/advisories/62560
http://secunia.com/advisories/62661
http://www.mandriva.com/security/advisories?name=MDVSA-2015:047
http://www.openwall.com/lists/oss-security/2014/12/29/2
http://www.securityfocus.com/bid/71804
https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e Vendor Advisory
https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html
http://advisories.mageia.org/MGASA-2015-0033.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html
http://secunia.com/advisories/61934
http://secunia.com/advisories/62560
http://secunia.com/advisories/62661
http://www.mandriva.com/security/advisories?name=MDVSA-2015:047
http://www.openwall.com/lists/oss-security/2014/12/29/2
http://www.securityfocus.com/bid/71804
https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e Vendor Advisory
https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html

Track CVE-2014-9447 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-16402Elfutils project elfutils double free vulnerabilitylibelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecif…EPSS 3.7%7.8CVE-2018-8769Elfutils project elfutils out-of-bounds read vulnerabilityelfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_SHNDX is unsupported.EPSS 0.84%6.8CVE-2014-0172Elfutils project elfutils vulnerabilityInteger overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows…EPSS 4.0%6.5CVE-2019-7148Elfutils project elfutils allocation without limits vulnerabilityAn attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers …EPSS 1.6%6.5CVE-2019-7149Elfutils project elfutils out-of-bounds read vulnerabilityA heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cau…EPSS 2.2%6.5CVE-2018-18520Elfutils project elfutils memory buffer overflow vulnerabilityAn Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar…EPSS 2.8%5.5CVE-2020-21047Elfutils project elfutils out-of-bounds write vulnerabilityThe libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by applica…EPSS 0.24%5.5CVE-2021-33294Elfutils project elfutils vulnerabilityIn elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infini…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2014-9447), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.