REDHAT-BUG-1646482: Low severity elfutils vulnerability
A flaw was found in elfutils 0.174. A Divide-by-zero vulnerabilities in the function arlibaddsymbols() in arlib.c allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero shentsize is mishandled.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23786 https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html
Upstream Patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=2b16a9be69939822dcafe075413468daac98b327
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1646482?
The severity of REDHAT-BUG-1646482 is considered high due to its potential to cause a denial of service.
How do I fix REDHAT-BUG-1646482?
To address REDHAT-BUG-1646482, you should update the elfutils package to the latest version that contains the patch.
Who is affected by REDHAT-BUG-1646482?
REDHAT-BUG-1646482 affects users of the elfutils library, specifically those utilizing versions susceptible to the divide-by-zero flaw.
What causes the REDHAT-BUG-1646482 vulnerability?
The REDHAT-BUG-1646482 vulnerability is caused by mishandling of a zero sh_entsize value within the arlib_add_symbols() function.
What is the impact of REDHAT-BUG-1646482?
The impact of REDHAT-BUG-1646482 is that it can lead to application crashes when processing maliciously crafted ELF files.