REDHAT-BUG-1394802: Low severity libdwarf dwarfdump vulnerability

Published Nov 14, 2016

Updated

An out of bounds heap read was found in dwarfskimforms in dwarfmacro5.c triggered by crafted input to dwarfdump utility.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6/

CVE assignment:

http://seclists.org/oss-sec/2016/q4/401

Affected Software

1 affected component

libdwarf dwarfdump

Event History

Nov 14, 2016

Data Sourced

via Red Hat·01:25 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to trigger this issue?

The attacker needs to supply crafted input that is processed by the dwarfdump utility. The issue is an out-of-bounds heap read in _dwarf_skim_forms in dwarf_macro5.c.

Which component should be prioritized for remediation?

Prioritize systems that use the dwarfdump utility from Libdwarf to inspect untrusted or externally supplied DWARF data. The provided information does not identify other affected Libdwarf consumers or configurations.

Is an upstream fix available?

Yes. An upstream patch is referenced at commit 583f8834083b5ef834c497f5b47797e16101a9a6.

REDHAT-BUG-1394802: Low severity libdwarf dwarfdump vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker control to trigger this issue?

Which component should be prioritized for remediation?

Is an upstream fix available?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to trigger this issue?

Which component should be prioritized for remediation?

Is an upstream fix available?