PT-2017-10038 · None · Libdwarf

Adam Mariš · Published 2017-03-23 · Updated 2022-03-01 · CVE-2016-9276

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Libdwarf versions prior to 20161124

Description The issue allows remote attackers to cause a denial of service, specifically an out-of-bounds read, through the dwarf get aranges list function in dwarf arrange.c.

Recommendations For versions prior to 20161124, update to version 20161124 or later to resolve the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-9276

Affected Products

Libdwarf

References · 12

• https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9276 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-9276 · Vendor Advisory
• https://blogs.gentoo.org/ago/2016/11/07/libdwarf-heap-based-buffer-overflow-in-dwarf_get_aranges_list-dwarf_arange-c · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1394804 · Patch
• https://ubuntu.com/security/CVE-2016-9276 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9276 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9276 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9276 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/11/11/9 · Patch
• https://osv.dev/vulnerability/CVE-2016-9276 · Vendor Advisory
• http://securityfocus.com/bid/94284 · Note