PT-2017-10205 · None · Libdwarf

Published 2017-02-28 · Updated 2022-03-01 · CVE-2016-9558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 20161124

Description The issue is related to a "negation overflow" caused by a crafted bit pattern in a signed leb number. This can be exploited by remote attackers to have an unspecified impact. The problem lies in the dwarf leb.c and print frames.c files of the libdwarf library.

Recommendations For libdwarf versions prior to 20161124, update to version 20161124 or later to resolve the issue.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2016-9558

Affected Products

Libdwarf

References · 13

• 🔥 https://blogs.gentoo.org/ago/2016/11/19/libdwarf-negation-overflow-in-dwarf_leb-c · Exploit
• https://ubuntu.com/security/CVE-2016-9558 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9558 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/11/19/6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9558 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9558 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9558 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9558 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9558 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/11/23/3 · Patch
• https://prevanders.net/dwarfbug.html · Note
• https://sourceforge.net/p/libdwarf/code/ci/4f19e1050cd8e9ddf2cb6caa061ff2fec4c9b5f9/#diff-5 · Note
• http://securityfocus.com/bid/94491 · Note