Skip to content
OpenAdvisories
Medium SUSE-RU-2025:4092-1 4 CVEs

Security update for elfutils

Published Nov 24, 2025 · Updated Mar 23, 2026

Ecosystem: openSUSE Ecosystem: SUSE

Summary

This update for elfutils fixes the following issues:

- Fixing build/testsuite for more recent glibc and kernels.

- Fixing denial of service and general buffer overflow errors
(bsc#1237236, bsc#1237240, bsc#1237241, bsc#1237242):

- CVE-2025-1376: Fixed denial of service in function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip
- CVE-2025-1377: Fixed denial of service in function gelf_getsymshndx of the file strip.c of the component eu-strip
- CVE-2025-1372: Fixed buffer overflow in function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf
- CVE-2025-1352: Fixed SEGV (illegal read access) in function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf

- Fixing testsuite race conditions in run-debuginfod-find.sh.

Fixed packages 29

ReleasePackageFixed in
openSUSE · Leap 15.6 elfutils 0.185-150400.5.8.3
openSUSE · Leap 15.6 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-ESPOS elfutils 0.185-150400.5.8.3
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-ESPOS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-LTSS elfutils 0.185-150400.5.8.3
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-LTSS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-ESPOS elfutils 0.185-150400.5.8.3
SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-ESPOS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-LTSS elfutils 0.185-150400.5.8.3
SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-LTSS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLE Micro 5.3 Linux Enterprise Micro 5.3 elfutils 0.185-150400.5.8.3
SUSE · SLE Micro 5.4 Linux Enterprise Micro 5.4 elfutils 0.185-150400.5.8.3
SUSE · SLE Micro 5.5 Linux Enterprise Micro 5.5 elfutils 0.185-150400.5.8.3
SUSE · SLES 15 SP6 Linux Enterprise Module for Basesystem 15 SP6 elfutils 0.185-150400.5.8.3
SUSE · SLES 15 SP6 Linux Enterprise Module for Basesystem 15 SP6 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLES 15 SP7 Linux Enterprise Module for Basesystem 15 SP7 elfutils 0.185-150400.5.8.3
SUSE · SLES 15 SP7 Linux Enterprise Module for Basesystem 15 SP7 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLES 15 SP4 Linux Enterprise Server 15 SP4-LTSS elfutils 0.185-150400.5.8.3
SUSE · SLES 15 SP4 Linux Enterprise Server 15 SP4-LTSS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLES 15 SP5 Linux Enterprise Server 15 SP5-LTSS elfutils 0.185-150400.5.8.3
SUSE · SLES 15 SP5 Linux Enterprise Server 15 SP5-LTSS elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLES for SAP 15 SP4 Linux Enterprise Server for SAP Applications 15 SP4 elfutils 0.185-150400.5.8.3
SUSE · SLES for SAP 15 SP4 Linux Enterprise Server for SAP Applications 15 SP4 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · SLES for SAP 15 SP5 Linux Enterprise Server for SAP Applications 15 SP5 elfutils 0.185-150400.5.8.3
SUSE · SLES for SAP 15 SP5 Linux Enterprise Server for SAP Applications 15 SP5 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · Manager Proxy LTS 4.3 elfutils 0.185-150400.5.8.3
SUSE · Manager Proxy LTS 4.3 elfutils-debuginfod 0.185-150400.5.8.2
SUSE · Manager Server LTS 4.3 elfutils 0.185-150400.5.8.3
SUSE · Manager Server LTS 4.3 elfutils-debuginfod 0.185-150400.5.8.2

Vulnerabilities 4

  • Medium 5.3
    CVE-2025-1372

    GNU elfutils eu-readelf readelf.c print_string_section buffer overflow

    A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x le…

    GNU elfutils elfutils elfutils Debian Ubuntu Azure Linux
  • Medium 5.0
    CVE-2025-1352

    GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption

    A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruptio…

    GNU elfutils elfutils elfutils Debian Ubuntu Azure Linux
  • Low 3.3
    CVE-2025-1377

    GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service

    A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be app…

    GNU elfutils elfutils elfutils Debian Ubuntu Azure Linux
  • Low 2.5
    CVE-2025-1376

    GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service

    A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch …

    GNU elfutils elfutils elfutils Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.suse.com/1237236
  • report
    https://bugzilla.suse.com/1237240
  • report
    https://bugzilla.suse.com/1237241
  • report
    https://bugzilla.suse.com/1237242
  • web
    https://www.suse.com/security/cve/CVE-2025-1352
  • web
    https://www.suse.com/security/cve/CVE-2025-1372
  • web
    https://www.suse.com/security/cve/CVE-2025-1376
  • web
    https://www.suse.com/security/cve/CVE-2025-1377