Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.891689
Category:Debian Local Security Checks
Title:Debian LTS: Security Advisory for elfutils (DLA-1689-1)
Summary:Several issues in elfutils, a collection of utilities to handle ELF;objects, have been found either by fuzzing or by using an;AddressSanitizer.;;CVE-2019-7665;Due to a heap-buffer-overflow problem in function elf32_xlatetom();a crafted ELF input can cause segmentation faults.;;CVE-2019-7150;Add sanity check for partial core file dynamic data read.;;CVE-2019-7149;Due to a heap-buffer-overflow problem in function read_srclines();a crafted ELF input can cause segmentation faults.;;CVE-2018-18521;By using a crafted ELF file, containing a zero sh_entsize, a;divide-by-zero vulnerability could allow remote attackers to;cause a denial of service (application crash).;;CVE-2018-18520;By fuzzing an Invalid Address Deference problem in function elf_end;has been found.;;CVE-2018-18310;By fuzzing an Invalid Address Read problem in eu-stack has been;found.;;CVE-2018-16062;By using an AddressSanitizer a heap-buffer-overflow has been found.;;CVE-2017-7613;By using fuzzing it was found that an allocation failure was not;handled properly.;;CVE-2017-7612;By using a crafted ELF file, containing an invalid sh_entsize, remote;attackers could cause a denial of service (application crash).;;CVE-2017-7611;By using a crafted ELF file remote attackers could cause a denial;of service (application crash).;;CVE-2017-7610;By using a crafted ELF file remote attackers could cause a denial;of service (application crash).;;CVE-2017-7608;By fuzzing a heap based buffer overflow has been detected.
Description:Summary:
Several issues in elfutils, a collection of utilities to handle ELF
objects, have been found either by fuzzing or by using an
AddressSanitizer.

CVE-2019-7665
Due to a heap-buffer-overflow problem in function elf32_xlatetom()
a crafted ELF input can cause segmentation faults.

CVE-2019-7150
Add sanity check for partial core file dynamic data read.

CVE-2019-7149
Due to a heap-buffer-overflow problem in function read_srclines()
a crafted ELF input can cause segmentation faults.

CVE-2018-18521
By using a crafted ELF file, containing a zero sh_entsize, a
divide-by-zero vulnerability could allow remote attackers to
cause a denial of service (application crash).

CVE-2018-18520
By fuzzing an Invalid Address Deference problem in function elf_end
has been found.

CVE-2018-18310
By fuzzing an Invalid Address Read problem in eu-stack has been
found.

CVE-2018-16062
By using an AddressSanitizer a heap-buffer-overflow has been found.

CVE-2017-7613
By using fuzzing it was found that an allocation failure was not
handled properly.

CVE-2017-7612
By using a crafted ELF file, containing an invalid sh_entsize, remote
attackers could cause a denial of service (application crash).

CVE-2017-7611
By using a crafted ELF file remote attackers could cause a denial
of service (application crash).

CVE-2017-7610
By using a crafted ELF file remote attackers could cause a denial
of service (application crash).

CVE-2017-7608
By fuzzing a heap based buffer overflow has been detected.

Affected Software/OS:
elfutils on Debian Linux

Solution:
For Debian 8 'Jessie', these problems have been fixed in version
0.159-4.2+deb8u1.

We recommend that you upgrade your elfutils packages.

CVSS Score:
4.3

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2017-7608
BugTraq ID: 98609
http://www.securityfocus.com/bid/98609
https://security.gentoo.org/glsa/201710-10
https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c
https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
SuSE Security Announcement: openSUSE-SU-2019:1590 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
https://usn.ubuntu.com/3670-1/
Common Vulnerability Exposure (CVE) ID: CVE-2017-7610
https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c
Common Vulnerability Exposure (CVE) ID: CVE-2017-7611
https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c
Common Vulnerability Exposure (CVE) ID: CVE-2017-7612
https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c
Common Vulnerability Exposure (CVE) ID: CVE-2017-7613
https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c
Common Vulnerability Exposure (CVE) ID: CVE-2019-7149
https://sourceware.org/bugzilla/show_bug.cgi?id=24102
https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html
RedHat Security Advisories: RHSA-2019:2197
https://access.redhat.com/errata/RHSA-2019:2197
RedHat Security Advisories: RHSA-2019:3575
https://access.redhat.com/errata/RHSA-2019:3575
https://usn.ubuntu.com/4012-1/
Common Vulnerability Exposure (CVE) ID: CVE-2019-7150
https://sourceware.org/bugzilla/show_bug.cgi?id=24103
https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html
Common Vulnerability Exposure (CVE) ID: CVE-2019-7665
https://sourceware.org/bugzilla/show_bug.cgi?id=24089
https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html
CopyrightCopyright (C) 2019 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.