libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable() that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.

An out of bounds heap read was found in dwarfgetarangeslist in dwarfarrange.c triggered by crafted input to dwarfdump utility.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6/

CVE assignment:

http://seclists.org/oss-sec/2016/q4/403

An out of bounds heap read was found in dwarfskimforms in dwarfmacro5.c triggered by crafted input to dwarfdump utility.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6/

CVE assignment:

http://seclists.org/oss-sec/2016/q4/401

An out of bounds heap read vulnerability was found in dwarfgetabbrevforcode triggered by invoking dwarfdump command on crafted file.

Upstream patches:

https://sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f3792964c46214f/#diff-13 https://sourceforge.net/p/libdwarf/code/ci/efe48cad0693d6994d9a7b561e1c3833b073a624/#diff-2

CVE assignment:

http://seclists.org/oss-sec/2016/q4/146

An out of bounds heap read vulnerability was found in dwarfgetsizeofval triggered by invoking dwarfdump command on crafted file.

Upstream patches:

https://sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f3792964c46214f/#diff-13 https://sourceforge.net/p/libdwarf/code/ci/efe48cad0693d6994d9a7b561e1c3833b073a624/#diff-2

CVE assignment:

http://seclists.org/oss-sec/2016/q4/144

An out of bounds heap read vulnerability was found in dwarfgetabbrevforcode triggered by invoking dwarfdump command on crafted file.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/268c1f18d1d28612af3b72d7c670076b1b88e51c/tree/libdwarf/dwarfutil.c?diff=0b28b923c3bd9827d1d904feed2abadde4fa5de2

CVE assignment:

http://seclists.org/oss-sec/2016/q4/145

Use-after-free vulnerability was reported in libdwarf [1]. If dwarfdump is passed a corrupted ELF file, 'DwarfDebug' object will be freed in 'dwarfelfobjectaccessfinish', but then this object is being referenced later in 'printerror':

-------------------------------- res = dwarfobjectinit(binaryinterface, errhand, errarg, retdbg, error); if (res != DWDLVOK){ dwarfelfobjectaccessfinish(binaryinterface); } -------------------------------- ... -------------------------- if (obj->object) { dwarfelfobjectaccessinternalst internals = (dwarfelfobjectaccessinternalst )obj->object; --------------------------

[1]: https://bugzilla.redhat.com/showbug.cgi?id=1177758