Vulnerability-Lookup

RHSA-2019:2197

Vulnerability from csaf_opensuse - Published: 2019-08-06 00:00 - Updated: 2026-09-20 11:04

Summary

security update for elfutils

Severity

Low

Notes

Title of the patch: security update for elfutils

Description of the patch: This security update provides a functional equivalent of RHSA-2019:2197. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2019:2197.

Patchnames: RHSA-2019:2197

CVE-2018-16062

5.4 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2018-16402

4.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact moderate

CVE-2018-16403

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2018-18310

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2018-18520

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2018-18521

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2019-7149

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact moderate

CVE-2019-7150

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2019-7664

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

CVE-2019-7665

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 14 products, the same list as for CVE-2018-16062

Threats

Impact low

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2018-16062/	self
https://www.suse.com/security/cve/CVE-2018-16402/	self
https://www.suse.com/security/cve/CVE-2018-16403/	self
https://www.suse.com/security/cve/CVE-2018-18310/	self
https://www.suse.com/security/cve/CVE-2018-18520/	self
https://www.suse.com/security/cve/CVE-2018-18521/	self
https://www.suse.com/security/cve/CVE-2019-7149/	self
https://www.suse.com/security/cve/CVE-2019-7150/	self
https://www.suse.com/security/cve/CVE-2019-7664/	self
https://www.suse.com/security/cve/CVE-2019-7665/	self
https://www.suse.com/security/cve/CVE-2018-16062	external
https://bugzilla.suse.com/1106390	external
https://www.suse.com/security/cve/CVE-2018-16402	external
https://bugzilla.suse.com/1107066	external
https://www.suse.com/security/cve/CVE-2018-16403	external
https://bugzilla.suse.com/1107067	external
https://www.suse.com/security/cve/CVE-2018-18310	external
https://bugzilla.suse.com/1111973	external
https://www.suse.com/security/cve/CVE-2018-18520	external
https://bugzilla.suse.com/1112726	external
https://www.suse.com/security/cve/CVE-2018-18521	external
https://bugzilla.suse.com/1112723	external
https://www.suse.com/security/cve/CVE-2019-7149	external
https://bugzilla.suse.com/1123559	external
https://www.suse.com/security/cve/CVE-2019-7150	external
https://bugzilla.suse.com/1123685	external
https://www.suse.com/security/cve/CVE-2019-7664	external
https://bugzilla.suse.com/1125008	external
https://www.suse.com/security/cve/CVE-2019-7665	external
https://bugzilla.suse.com/1125007	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for elfutils",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2019:2197.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2019:2197.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2019:2197",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2019_2197.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16062 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16062/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16402 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16402/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16403 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16403/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-18310 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-18310/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-18520 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-18520/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-18521 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-18521/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-7149 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-7149/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-7150 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-7150/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-7664 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-7664/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-7665 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-7665/"
      }
    ],
    "title": "security update for elfutils",
    "tracking": {
      "current_release_date": "2026-09-20T11:04:30Z",
      "generator": {
        "date": "2019-08-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2019:2197",
      "initial_release_date": "2019-08-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2019-08-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:04:30Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "elfutils-devel-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-devel-0:0.176-2.el7.i686",
                  "product_id": "elfutils-devel-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-devel@0.176-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-devel-static-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-devel-static-0:0.176-2.el7.i686",
                  "product_id": "elfutils-devel-static-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-devel-static@0.176-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-libelf-0:0.176-2.el7.i686",
                  "product_id": "elfutils-libelf-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf@0.176-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-devel-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-libelf-devel-0:0.176-2.el7.i686",
                  "product_id": "elfutils-libelf-devel-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf-devel@0.176-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-devel-static-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-libelf-devel-static-0:0.176-2.el7.i686",
                  "product_id": "elfutils-libelf-devel-static-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf-devel-static@0.176-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libs-0:0.176-2.el7.i686",
                "product": {
                  "name": "elfutils-libs-0:0.176-2.el7.i686",
                  "product_id": "elfutils-libs-0:0.176-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libs@0.176-2.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "elfutils-default-yama-scope-0:0.176-2.el7.noarch",
                "product": {
                  "name": "elfutils-default-yama-scope-0:0.176-2.el7.noarch",
                  "product_id": "elfutils-default-yama-scope-0:0.176-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-default-yama-scope@0.176-2.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "elfutils-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:elfutils_project:elfutils:0.176:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/elfutils@0.176-2.el7?arch=x86_64\u0026upstream=elfutils-0:0.176-2.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-devel-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-devel-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-devel-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-devel@0.176-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-devel-static-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-devel-static-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-devel-static-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-devel-static@0.176-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-libelf-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-libelf-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf@0.176-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-devel-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-libelf-devel-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-libelf-devel-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf-devel@0.176-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libelf-devel-static@0.176-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libs-0:0.176-2.el7.x86_64",
                "product": {
                  "name": "elfutils-libs-0:0.176-2.el7.x86_64",
                  "product_id": "elfutils-libs-0:0.176-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/elfutils-libs@0.176-2.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-default-yama-scope-0:0.176-2.el7.noarch as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch"
        },
        "product_reference": "elfutils-default-yama-scope-0:0.176-2.el7.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-devel-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-devel-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-devel-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-devel-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-devel-static-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-devel-static-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-devel-static-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-devel-static-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-libelf-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-libelf-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-devel-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-libelf-devel-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-devel-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-libelf-devel-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-devel-static-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-libelf-devel-static-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-devel-static-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libs-0:0.176-2.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686"
        },
        "product_reference": "elfutils-libs-0:0.176-2.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libs-0:0.176-2.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        },
        "product_reference": "elfutils-libs-0:0.176-2.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-16062",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16062"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16062",
          "url": "https://www.suse.com/security/cve/CVE-2018-16062"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1106390 for CVE-2018-16062",
          "url": "https://bugzilla.suse.com/1106390"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16062"
    },
    {
      "cve": "CVE-2018-16402",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16402"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16402",
          "url": "https://www.suse.com/security/cve/CVE-2018-16402"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1107066 for CVE-2018-16402",
          "url": "https://bugzilla.suse.com/1107066"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16402"
    },
    {
      "cve": "CVE-2018-16403",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16403"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16403",
          "url": "https://www.suse.com/security/cve/CVE-2018-16403"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1107067 for CVE-2018-16403",
          "url": "https://bugzilla.suse.com/1107067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-16403"
    },
    {
      "cve": "CVE-2018-18310",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-18310"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-18310",
          "url": "https://www.suse.com/security/cve/CVE-2018-18310"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111973 for CVE-2018-18310",
          "url": "https://bugzilla.suse.com/1111973"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-18310"
    },
    {
      "cve": "CVE-2018-18520",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-18520"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-18520",
          "url": "https://www.suse.com/security/cve/CVE-2018-18520"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1112726 for CVE-2018-18520",
          "url": "https://bugzilla.suse.com/1112726"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-18520"
    },
    {
      "cve": "CVE-2018-18521",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-18521"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-18521",
          "url": "https://www.suse.com/security/cve/CVE-2018-18521"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1112723 for CVE-2018-18521",
          "url": "https://bugzilla.suse.com/1112723"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-18521"
    },
    {
      "cve": "CVE-2019-7149",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-7149"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-7149",
          "url": "https://www.suse.com/security/cve/CVE-2019-7149"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123559 for CVE-2019-7149",
          "url": "https://bugzilla.suse.com/1123559"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-7149"
    },
    {
      "cve": "CVE-2019-7150",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-7150"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-7150",
          "url": "https://www.suse.com/security/cve/CVE-2019-7150"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123685 for CVE-2019-7150",
          "url": "https://bugzilla.suse.com/1123685"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-7150"
    },
    {
      "cve": "CVE-2019-7664",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-7664"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-7664",
          "url": "https://www.suse.com/security/cve/CVE-2019-7664"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1125008 for CVE-2019-7664",
          "url": "https://bugzilla.suse.com/1125008"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-7664"
    },
    {
      "cve": "CVE-2019-7665",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-7665"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
          "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-7665",
          "url": "https://www.suse.com/security/cve/CVE-2019-7665"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1125007 for CVE-2019-7665",
          "url": "https://bugzilla.suse.com/1125007"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:elfutils-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-default-yama-scope-0:0.176-2.el7.noarch",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libelf-devel-static-0:0.176-2.el7.x86_64",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.i686",
            "SUSE Liberty Linux 7:elfutils-libs-0:0.176-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-08-06T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-7665"
    }
  ]
}

CVE-2018-16062 (GCVE-0-2018-16062)

Vulnerability from cvelistv5 – Published: 2018-08-29 03:00 – Updated: 2024-08-05 10:10

Summary

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://sourceware.org/git/?p=elfutils.git%3Ba=co…	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=23541	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-08-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:10:05.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/git/?p=elfutils.git%3Ba=commit%3Bh=29e31978ba51c1051743a503ee325b5ebc03d7e9"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23541"
          },
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:10.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/git/?p=elfutils.git%3Ba=commit%3Bh=29e31978ba51c1051743a503ee325b5ebc03d7e9"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23541"
        },
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16062",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/git/?p=elfutils.git;a=commit;h=29e31978ba51c1051743a503ee325b5ebc03d7e9",
              "refsource": "MISC",
              "url": "https://sourceware.org/git/?p=elfutils.git;a=commit;h=29e31978ba51c1051743a503ee325b5ebc03d7e9"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23541",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23541"
            },
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16062",
    "datePublished": "2018-08-29T03:00:00.000Z",
    "dateReserved": "2018-08-28T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:10:05.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16402 (GCVE-0-2018-16402)

Vulnerability from cvelistv5 – Published: 2018-09-03 19:00 – Updated: 2024-08-05 10:24

Summary

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=23528	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://lists.apache.org/thread.html/r1b103833cb5…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-09-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:31.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23528"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:08.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23528"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16402",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23528",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23528"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16402",
    "datePublished": "2018-09-03T19:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:31.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16403 (GCVE-0-2018-16403)

Vulnerability from cvelistv5 – Published: 2018-09-03 19:00 – Updated: 2024-08-05 10:24

Summary

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

5 references

URL	Tags
https://sourceware.org/git/?p=elfutils.git%3Ba=co…	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=23529	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT

Date Public

2018-09-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:24:32.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/git/?p=elfutils.git%3Ba=commit%3Bh=6983e59b727458a6c64d9659c85f08218bc4fcda"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23529"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-06T16:06:21.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/git/?p=elfutils.git%3Ba=commit%3Bh=6983e59b727458a6c64d9659c85f08218bc4fcda"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23529"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-16403",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda",
              "refsource": "MISC",
              "url": "https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23529",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23529"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-16403",
    "datePublished": "2018-09-03T19:00:00.000Z",
    "dateReserved": "2018-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:24:32.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-18310 (GCVE-0-2018-18310)

Vulnerability from cvelistv5 – Published: 2018-10-15 02:00 – Updated: 2024-08-05 11:08

Summary

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=23752	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/ml/elfutils-devel/2018-q4/…	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:08:21.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23752"
          },
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23752"
        },
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18310",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23752",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23752"
            },
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18310",
    "datePublished": "2018-10-15T02:00:00.000Z",
    "dateReserved": "2018-10-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:08:21.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-18520 (GCVE-0-2018-18520)

Vulnerability from cvelistv5 – Published: 2018-10-19 17:00 – Updated: 2024-08-05 11:15

Summary

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/ml/elfutils-devel/2018-q4/…	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=23787	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-10-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:15:58.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23787"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:12.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23787"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18520",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23787",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23787"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18520",
    "datePublished": "2018-10-19T17:00:00.000Z",
    "dateReserved": "2018-10-19T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:15:58.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-18521 (GCVE-0-2018-18521)

Vulnerability from cvelistv5 – Published: 2018-10-19 17:00 – Updated: 2024-08-05 11:15

Summary

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/ml/elfutils-devel/2018-q4/…	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=23786	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-10-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:15:58.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23786"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23786"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18521",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=23786",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23786"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18521",
    "datePublished": "2018-10-19T17:00:00.000Z",
    "dateReserved": "2018-10-19T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:15:58.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-7149 (GCVE-0-2019-7149)

Vulnerability from cvelistv5 – Published: 2019-01-29 00:00 – Updated: 2024-08-04 20:38

Summary

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://sourceware.org/ml/elfutils-devel/2019-q1/…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/bugzilla/show_bug.cgi?id=24102	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3575	vendor-advisoryx_refsource_REDHAT

Date Public

2019-01-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:38:33.391Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html"
          },
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24102"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "RHSA-2019:3575",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3575"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T00:06:57.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html"
        },
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24102"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "RHSA-2019:3575",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3575"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-7149",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html"
            },
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=24102",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24102"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "RHSA-2019:3575",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3575"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-7149",
    "datePublished": "2019-01-29T00:00:00.000Z",
    "dateReserved": "2019-01-28T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:38:33.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-7150 (GCVE-0-2019-7150)

Vulnerability from cvelistv5 – Published: 2019-01-29 00:00 – Updated: 2024-08-04 20:38

Summary

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

8 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=24103	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/ml/elfutils-devel/2019-q1/…	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3575	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2019-01-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:38:33.393Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24103"
          },
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "RHSA-2019:3575",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3575"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24103"
        },
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "RHSA-2019:3575",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3575"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-7150",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=24103",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24103"
            },
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "RHSA-2019:3575",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3575"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-7150",
    "datePublished": "2019-01-29T00:00:00.000Z",
    "dateReserved": "2019-01-28T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:38:33.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-7664 (GCVE-0-2019-7664)

Vulnerability from cvelistv5 – Published: 2019-02-09 16:00 – Updated: 2024-08-04 20:54

Summary

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=24084	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3575	vendor-advisoryx_refsource_REDHAT

Date Public

2019-02-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:54:28.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24084"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "RHSA-2019:3575",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3575"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-02-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T00:06:59.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24084"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "RHSA-2019:3575",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3575"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-7664",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=24084",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24084"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "RHSA-2019:3575",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3575"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-7664",
    "datePublished": "2019-02-09T16:00:00.000Z",
    "dateReserved": "2019-02-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:54:28.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-7665 (GCVE-0-2019-7665)

Vulnerability from cvelistv5 – Published: 2019-02-09 16:00 – Updated: 2024-08-04 20:54

Summary

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

8 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=24089	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://sourceware.org/ml/elfutils-devel/2019-q1/…	x_refsource_MISC
https://usn.ubuntu.com/4012-1/	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:3575	vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2019-02-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:54:28.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24089"
          },
          {
            "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html"
          },
          {
            "name": "USN-4012-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4012-1/"
          },
          {
            "name": "openSUSE-SU-2019:1590",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
          },
          {
            "name": "RHSA-2019:2197",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2197"
          },
          {
            "name": "RHSA-2019:3575",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3575"
          },
          {
            "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-02-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-31T00:06:20.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24089"
        },
        {
          "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html"
        },
        {
          "name": "USN-4012-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4012-1/"
        },
        {
          "name": "openSUSE-SU-2019:1590",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
        },
        {
          "name": "RHSA-2019:2197",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2197"
        },
        {
          "name": "RHSA-2019:3575",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3575"
        },
        {
          "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-7665",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=24089",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24089"
            },
            {
              "name": "[debian-lts-announce] 20190225 [SECURITY] [DLA 1689-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html"
            },
            {
              "name": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html",
              "refsource": "MISC",
              "url": "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html"
            },
            {
              "name": "USN-4012-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4012-1/"
            },
            {
              "name": "openSUSE-SU-2019:1590",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"
            },
            {
              "name": "RHSA-2019:2197",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2197"
            },
            {
              "name": "RHSA-2019:3575",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3575"
            },
            {
              "name": "[debian-lts-announce] 20211030 [SECURITY] [DLA 2802-1] elfutils security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-7665",
    "datePublished": "2019-02-09T16:00:00.000Z",
    "dateReserved": "2019-02-09T00:00:00.000Z",
    "dateUpdated": "2024-08-04T20:54:28.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2019:2197

CVE-2018-16062 (GCVE-0-2018-16062)

CVE-2018-16402 (GCVE-0-2018-16402)

CVE-2018-16403 (GCVE-0-2018-16403)

CVE-2018-18310 (GCVE-0-2018-18310)

CVE-2018-18520 (GCVE-0-2018-18520)

CVE-2018-18521 (GCVE-0-2018-18521)

CVE-2019-7149 (GCVE-0-2019-7149)

CVE-2019-7150 (GCVE-0-2019-7150)

CVE-2019-7664 (GCVE-0-2019-7664)

CVE-2019-7665 (GCVE-0-2019-7665)

Tags

Sightings

Nomenclature

Related by attack behaviour