6.8

CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Glibc Version <= 2.19
Gnu ≫ Glibc Version2.0
Gnu ≫ Glibc Version2.0.1
Gnu ≫ Glibc Version2.0.2
Gnu ≫ Glibc Version2.0.3
Gnu ≫ Glibc Version2.0.4
Gnu ≫ Glibc Version2.0.5
Gnu ≫ Glibc Version2.0.6
Gnu ≫ Glibc Version2.1
Gnu ≫ Glibc Version2.1.1
Gnu ≫ Glibc Version2.1.1.6
Gnu ≫ Glibc Version2.1.2
Gnu ≫ Glibc Version2.1.3
Gnu ≫ Glibc Version2.1.9
Gnu ≫ Glibc Version2.10.1
Gnu ≫ Glibc Version2.11
Gnu ≫ Glibc Version2.11.1
Gnu ≫ Glibc Version2.11.2
Gnu ≫ Glibc Version2.11.3
Gnu ≫ Glibc Version2.12
Gnu ≫ Glibc Version2.12.1
Gnu ≫ Glibc Version2.12.2
Gnu ≫ Glibc Version2.13
Gnu ≫ Glibc Version2.14
Gnu ≫ Glibc Version2.14.1
Gnu ≫ Glibc Version2.15
Gnu ≫ Glibc Version2.16
Gnu ≫ Glibc Version2.17
Gnu ≫ Glibc Version2.18
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.69% 0.84
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://linux.oracle.com/errata/ELSA-2015-0092.html
http://www.debian.org/security/2014/dsa-2976
http://www.mandriva.com/security/advisories?name=MDVSA-2014:152
http://www.openwall.com/lists/oss-security/2014/07/10/7
http://www.openwall.com/lists/oss-security/2014/07/14/6
http://www.securityfocus.com/bid/68505
http://www.securitytracker.com/id/1030569
https://rhn.redhat.com/errata/RHSA-2014-1110.html
https://security.gentoo.org/glsa/201602-02
https://sourceware.org/bugzilla/show_bug.cgi?id=17137