CVE-2019-7665

Опубликовано: 09 фев. 2019

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2197
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3575
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html
Mailing List
Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=24089
Exploit
Issue Tracking
Third Party Advisory
https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html
Exploit
Mailing List
Third Party Advisory
https://usn.ubuntu.com/4012-1/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2197
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3575
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html
Mailing List
Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=24089
Exploit
Issue Tracking
Third Party Advisory
https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html
Exploit
Mailing List
Third Party Advisory
https://usn.ubuntu.com/4012-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:elfutils_project:elfutils:0.175:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 34%

0.00141

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2019-7665

CVSS3: 5.5

ubuntu

почти 7 лет назад

CVE-2019-7665

CVSS3: 3.3

redhat

около 7 лет назад

CVE-2019-7665

CVSS3: 5.5

debian

почти 7 лет назад

In elfutils 0.175, a heap-based buffer over-read was discovered in the ...

GHSA-j877-4r2v-qxff

CVSS3: 5.5

github

больше 3 лет назад

BDU:2019-01240

CVSS3: 5.5

fstec

почти 7 лет назад

Уязвимость функции elf32_xlatetom в пакете elfutils, связанная с возможностью выхода операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 34%

0.00141

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125