CVE-2014-8737: Canonical Ubuntu Linux

Low severity, CVSS 3.6. EPSS: 1% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only; version 14.10 only
• Fedoraproject Fedora: version 19 only; version 20 only; version 21 only
• GNU Binutils: up to and including 2.24

Published 2014-12-09. Last modified 2026-06-17.