Debian Elfutils vulnerabilities

CVE-2018-16403 [MEDIUM] CVE-2018-16403: elfutils - libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwa... libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash. Scope: local bookworm: resolved (fixed in 0.175-1) bullseye: resolved (fixed in 0.175-1) forky: resolved (fixed in 0.175-1) sid: resolved (fixed i

CVE-2019-7664 [MEDIUM] CVE-2019-7664: elfutils - In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libel... In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). Scope: local bookworm: resolved (fixed in 0.176-1) bullseye: resolved (fixed in 0.176-1) forky: resolved (fixed in 0.176-1) sid: resolved (

CVE-2018-18521 [MEDIUM] CVE-2018-18521: elfutils - Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in... Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Scope: local bookworm: resolved (fixed in 0.175-1) bullseye: resolved (fixed in 0.175-1) forky: resol

CVE-2021-33294 [MEDIUM] CVE-2021-33294: elfutils - In elfutils 0.183, an infinite loop was found in the function handle_symtab in r... In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file. Scope: local bookworm: resolved (fixed in 0.185-2) bullseye: open forky: resolved (fixed in 0.185-2) sid: resolved (fixed in 0.185-2) trixie: resolved (fixed in 0.185-2)

CVE-2018-18310 [MEDIUM] CVE-2018-18310: elfutils - An invalid memory address dereference was discovered in dwfl_segment_report_modu... An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes. Scope: local bookworm: resolved (fixed in 0.175-1) bullseye: resolved (fixed in 0.175-1) forky: r