Summary
It was discovered that elfutils incorrectly handled certain malformed
files. If a user or automated system were tricked into processing a
specially crafted file, elfutils could be made to crash or consume
resources, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-16062, CVE-2018-16403, CVE-2018-18310,
CVE-2018-18520, CVE-2018-18521, CVE-2019-7149, CVE-2019-7150,
CVE-2019-7665)
It was discovered that elfutils incorrectly handled bounds checks in
certain functions when processing malformed files. If a user or automated
system were tricked into processing a specially crafted file, elfutils
could be made to crash or consume resources, resulting in a denial of
service. (CVE-2020-21047, CVE-2021-33294)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | elfutils | 0.176-1.1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | elfutils | 0.158-0ubuntu5.3+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | elfutils | 0.165-3ubuntu1.2+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | elfutils | 0.170-0.4ubuntu0.1+esm1 |
Vulnerabilities 10
-
Unscored —
dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial…
-
Unscored —
libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and d…
-
Unscored —
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.…
-
Unscored —
An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-…
-
Unscored —
Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers …
-
Unscored —
A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils …
-
Unscored —
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf3…
-
Unscored —
In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in l…
-
Unscored —
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service v…
-
Unscored —
In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cau…
References
-
report
https://ubuntu.com/security/CVE-2018-16062
-
report
https://ubuntu.com/security/CVE-2018-16403
-
report
https://ubuntu.com/security/CVE-2018-18310
-
report
https://ubuntu.com/security/CVE-2018-18520
-
report
https://ubuntu.com/security/CVE-2018-18521
-
report
https://ubuntu.com/security/CVE-2019-7149
-
report
https://ubuntu.com/security/CVE-2019-7150
-
report
https://ubuntu.com/security/CVE-2019-7665
-
report
https://ubuntu.com/security/CVE-2020-21047
-
report
https://ubuntu.com/security/CVE-2021-33294