CVE-2016-9275: Buffer Overflow

Q: Which installations are affected?

Libdwarf versions before 20161124 are affected. The vulnerable code is reached through the dwarfdump utility when it processes crafted input.

Q: What does an attacker need to exploit this issue?

An attacker needs to supply crafted input for dwarfdump to process. The CVSS vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

Q: What is the practical impact?

Successful exploitation can cause a denial of service through an out-of-bounds heap read. The reported CVSS impact is limited to availability, with no confidentiality or integrity impact stated.

Q: What should be done to remediate it?

Apply the available upstream patch or upgrade to a Libdwarf release that is not before 20161124.

Published Nov 14, 2016

Updated

An out of bounds heap read was found in dwarfskimforms in dwarfmacro5.c triggered by crafted input to dwarfdump utility.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6/

CVE assignment:

http://seclists.org/oss-sec/2016/q4/401

Other sources

Heap-based buffer overflow in the dwarfskimforms function in libdwarf/dwarfmacro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).

— MITRE

Affected Software

1 affected component

Libdwarf Project Libdwarf>=1999-12-14<2016-11-24

Remediation

Event History

Nov 14, 2016

Data Sourced

01:25 PM

DescriptionSeverityAffected Software

Mar 23, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

Which installations are affected?

Libdwarf versions before 20161124 are affected. The vulnerable code is reached through the dwarfdump utility when it processes crafted input.

What does an attacker need to exploit this issue?

An attacker needs to supply crafted input for dwarfdump to process. The CVSS vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

What is the practical impact?

Successful exploitation can cause a denial of service through an out-of-bounds heap read. The reported CVSS impact is limited to availability, with no confidentiality or integrity impact stated.

What should be done to remediate it?

Apply the available upstream patch or upgrade to a Libdwarf release that is not before 20161124.

CVE-2016-9275: Buffer Overflow

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate it?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the practical impact?

What should be done to remediate it?