REDHAT-BUG-1385686: Medium severity libdwarf libdwarf vulnerability

Published Oct 17, 2016

Updated

An out of bounds heap read vulnerability was found in dwarfgetabbrevforcode triggered by invoking dwarfdump command on crafted file.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/268c1f18d1d28612af3b72d7c670076b1b88e51c/tree/libdwarf/dwarfutil.c?diff=0b28b923c3bd9827d1d904feed2abadde4fa5de2

CVE assignment:

http://seclists.org/oss-sec/2016/q4/145

Affected Software

1 affected component

libdwarf libdwarf

Event History

Oct 17, 2016

Data Sourced

via Red Hat·01:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker do to trigger the issue?

The attacker must cause dwarfdump to process a crafted file. The vulnerable code path is _dwarf_get_abbrev_for_code.

Which use of libdwarf is directly implicated?

The reported trigger is invoking the dwarfdump command on a crafted file. The available information does not establish exposure for other libdwarf consumers or configurations.

REDHAT-BUG-1385686: Medium severity libdwarf libdwarf vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the issue?

Which use of libdwarf is directly implicated?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the issue?

Which use of libdwarf is directly implicated?