NetSight
IP …
medium5.5

CVE-2019-7150

An issue was discovered in elfutils 0.175.

Impact

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

Affected products

VendorProductAffected versions
Elfutils ProjectElfutils
Version 0.175
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 18.10
OpensuseLeap
Versions 15.0, 15.1
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 8.2, 8.4
RedhatEnterprise Linux Server Tus
Versions 8.2, 8.4
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-125

References