An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarfformsdata() is due to a failure to check a pointer for being in bounds (in a few places in this function) and a failure in a check in dwarfattrlist().
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarfformsdata() a few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. In dwarfdecodesleb128chk() a byte pointer was dereferenced just before it was checked for being in bounds, leading to a heap-based buffer over-read.
(1) libdwarf/dwarfleb.c and (2) dwarfdump/printframes.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a "negation overflow."
An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarfreadlocexprop() is due to a failure to check a pointer for being in bounds (in a few places in this function).
There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarfglobalformrefb.
libdwarf 0.4.0 has a heap-based buffer over-read in dwarfcheckstringvalid in dwarfutil.c.
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
The getattrvalue function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
The dwarfdealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
The dwarfgetmacrostartendfile function in dwarfmacro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debugstr.
The dwarfgetarangeslist function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
The WRITEUNALIGNED function in dwarfelfaccess.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
An out of bounds heap read vulnerability was found in dwarfgetsizeofval triggered by invoking dwarfdump command on crafted file.
Upstream patches:
https://sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f3792964c46214f/#diff-13 https://sourceforge.net/p/libdwarf/code/ci/efe48cad0693d6994d9a7b561e1c3833b073a624/#diff-2
CVE assignment:
http://seclists.org/oss-sec/2016/q4/144
Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote attackers to cause a denial of service (program crash) via a crafted ELF file.
The createfullestfilepath function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted dwarf file.
The dwarfgetxuhashentry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted file.
An out of bounds heap read vulnerability was found in dwarfgetabbrevforcode triggered by invoking dwarfdump command on crafted file.
Upstream patch:
https://sourceforge.net/p/libdwarf/code/ci/268c1f18d1d28612af3b72d7c670076b1b88e51c/tree/libdwarf/dwarfutil.c?diff=0b28b923c3bd9827d1d904feed2abadde4fa5de2
CVE assignment:
http://seclists.org/oss-sec/2016/q4/145
The readlinetableprogram function in dwarflinetablereadercommon.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted input.
The dwarfcalculateinfosectionendptr function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
The printexprloccontent function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debugabbrev section marked NOBITS in an ELF file.
The dwarfreadlinetableheader function in dwarflinetablereader.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
The printframeinstbytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.
dwarfelfaccess.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file, related to relocation records.
The dwarfloadsection function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
The getabbrevarrayinfo function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted elf file.
dwarfelfloadheaders.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service