PT-2019-1675 · Red Hat+5 · Elfutils+6
Mark Wielaard
·
Publicado
2019-01-18
·
Atualizado
2023-08-30
·
CVE-2019-7149
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
elfutils version 0.175
Description
A heap-based buffer over-read was discovered in the
read srclines function in dwarf getsrclines.c in libdw in elfutils. This issue can be exploited by a crafted input, causing segmentation faults and leading to a denial-of-service (DoS). The vulnerability can be triggered by a specially prepared ELF file.Recommendations
For elfutils version 0.175, consider applying a patch to fix the
read srclines function in dwarf getsrclines.c to prevent the buffer over-read. As a temporary workaround, restrict the use of the eu-nm tool with untrusted ELF files until a patch is available.Exploit
Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linuxmint
Red Hat
Suse
Ubuntu
Elfutils