USN-2473-1: coreutils vulnerabilities
14 January 2015
date and touch could be made to crash or run programs if they handled specially crafted input.
- coreutils - GNU core utilities
It was discovered that the distcheck rule in dist-check.mk in GNU
coreutils allows local users to gain privileges via a symlink attack
on a directory tree under /tmp. This issue only affected Ubuntu 10.04 LTS.
Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly
handled user-supplied input. An attacker could possibly use this to cause
a denial of service or potentially execute code. (CVE-2014-9471)
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.