Summary
Agostino Sarubbo discovered that elfutils incorrectly handled certain
malformed ELF files. If a user or automated system were tricked into
processing a specially crafted ELF file, elfutils could be made to crash or
consume resources, resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | elfutils | 0.158-0ubuntu5.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | elfutils | 0.165-3ubuntu1.1 |
Vulnerabilities 9
-
Unscored —
The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (cr…
-
Unscored —
The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a d…
-
Unscored —
The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-…
-
Unscored —
The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a den…
-
Unscored —
elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause …
-
Unscored —
The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-base…
-
Unscored —
The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (he…
-
Unscored —
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-…
-
Unscored —
elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote at…
References
-
report
https://ubuntu.com/security/CVE-2016-10254
-
report
https://ubuntu.com/security/CVE-2016-10255
-
report
https://ubuntu.com/security/CVE-2017-7607
-
report
https://ubuntu.com/security/CVE-2017-7608
-
report
https://ubuntu.com/security/CVE-2017-7609
-
report
https://ubuntu.com/security/CVE-2017-7610
-
report
https://ubuntu.com/security/CVE-2017-7611
-
report
https://ubuntu.com/security/CVE-2017-7612
-
report
https://ubuntu.com/security/CVE-2017-7613