Unscored CVE-2016-5043 EUVD-2016-5996GHSA-f6fp-4hh9-m34r

The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) …

Published Feb 17, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: dwarfutils Package: dwarfutils Ecosystem: Debian Ecosystem: Ubuntu

Description

The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	dwarfutils	20160507-1	—
Debian 13	dwarfutils	20160507-1	—
Debian 12	dwarfutils	20160507-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	dwarfutils	No fix yet	—

References

https://www.prevanders.net/dwarfbug.html
[oss-security] 20160524 CVE request: Multiple vunerabilities in libdwarf & dwarfdump mailing-list
[oss-security] 20160524 Re: CVE request: Multiple vunerabilities in libdwarf & dwarfdump mailing-list