summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/elfutils/elfutils_0.161.bb
diff options
context:
space:
mode:
authorRoy Li <rongqing.li@windriver.com>2015-04-28 14:22:54 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-04-30 23:04:17 +0100
commit145abfc06bc633145185087acf04f480e237c62c (patch)
tree9246c1dc237acef1673b6a09fbf396be4bff5710 /meta/recipes-devtools/elfutils/elfutils_0.161.bb
parent927bc7148cba14b1ffe166a5670bcb1c7530ff5c (diff)
downloadpoky-145abfc06bc633145185087acf04f480e237c62c.tar.gz
elfutils: Security Advisory - CVE-2015-0255
Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9447 (From OE-Core rev: 4a65944b89a76f18c8ff6e148f17508882d387cf) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/elfutils/elfutils_0.161.bb')
-rw-r--r--meta/recipes-devtools/elfutils/elfutils_0.161.bb1
1 files changed, 1 insertions, 0 deletions
diff --git a/meta/recipes-devtools/elfutils/elfutils_0.161.bb b/meta/recipes-devtools/elfutils/elfutils_0.161.bb
index 0dbe9f95f2..e111b34a8a 100644
--- a/meta/recipes-devtools/elfutils/elfutils_0.161.bb
+++ b/meta/recipes-devtools/elfutils/elfutils_0.161.bb
@@ -16,6 +16,7 @@ SRC_URI += "\
16 file://Fix_elf_cvt_gunhash.patch \ 16 file://Fix_elf_cvt_gunhash.patch \
17 file://fixheadercheck.patch \ 17 file://fixheadercheck.patch \
18 file://0001-elf_getarsym-Silence-Werror-maybe-uninitialized-fals.patch \ 18 file://0001-elf_getarsym-Silence-Werror-maybe-uninitialized-fals.patch \
19 file://0001-libelf-Fix-dir-traversal-vuln-in-ar-extraction.patch \
19" 20"
20 21
21# pick the patch from debian 22# pick the patch from debian