Wind River Support Network

HomeDefectsLIN6-8907

Fixed

LIN6-8907 : Security Advisory - glibc - CVE-2014-7817

Created: Dec 1, 2014 Updated: Dec 3, 2018

Resolved Date: Jan 20, 2015

Found In Version: 6.0.0.13

Fix Version: 6.0.0.17

Severity: Standard

Applicable for: Wind River Linux 6

Component/s: Toolchain

Description

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing $((`...`)).

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7817

Other Downloads