Unscored CVE-2016-5037 EUVD-2016-5990GHSA-5fxq-xp5c-68mh

The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference…

Published Feb 17, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: dwarfutils Package: dwarfutils Ecosystem: Debian Ecosystem: Ubuntu

Description

The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	dwarfutils	20160507-1	—
Debian 13	dwarfutils	20160507-1	—
Debian 12	dwarfutils	20160507-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	dwarfutils	No fix yet	—

References

https://www.prevanders.net/dwarfbug.html
[oss-security] 20160524 CVE request: Multiple vunerabilities in libdwarf & dwarfdump mailing-list
[oss-security] 20160524 Re: CVE request: Multiple vunerabilities in libdwarf & dwarfdump mailing-list