Summary
[2.0.7-4]
- Prevent out-of-buonds memory access during object symbol table construction
(CVE-2026-35233). [Orabug: 39121881]
- Prevent divide-by-zero (FPE trap) if section header data is corrupted.
(CVE-2026-21996). [Orabug: 39121874]
- Ensure safety checks are performed on program header data from ELF objects.
- Ensure that the data of string table sections is proper terminated.
- Ensure that the symbol table references a valid string table.
Credit Statement:
The following people or organizations reported security vulnerabilities addressed by this ELSA to Oracle:
Vishal Panchani CVE-2026-35233 CVE-2026-21996
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | dtrace | 0:2.0.7-4.el10 |
| Oracle Linux · 9 | dtrace-devel | 0:2.0.7-4.el10 |
| Oracle Linux · 9 | dtrace-testsuite | 0:2.0.7-4.el10 |
Vulnerabilities 2
-
Medium 4.4
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link …
-
Low 3.3
An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integ…