CVE-2019-7665

CVE-2019-7665 affects elfutils 0.175, where a heap-based buffer over-read in elf32_xlatetom.c (libelf) can trigger a crash/DoS when processing crafted ELF input, due to malformed core file notes not being rejected. Upstream remediation is in elfutils 0.176; several advisories (Arch Linux ASA-2019...

CVE-2019-7150

The CVE-2019-7150 issue affects elfutils (0.175) where elf64_xlatetom in libelf/elf32_xlatetom.c can segfault because dwfl_segment_report_module does not check if core file dyn data is truncated. This leads to a crash/denial-of-service when processing crafted ELF inputs (as demonstrated by eu-sta...

CVE-2018-16062

CVE-2018-16062 affects elfutils (libdw/dwarf_getaranges.c) where the function dwarf_getaranges() can read beyond ELF section limits, allowing a crafted file to cause a denial of service via a heap-based buffer over-read. Public advisories and vendor notes link this to elfutils releases prior to 2...

CVE-2018-18310

CVE-2018-18310 is an invalid memory address dereference in libdwfl/dwfl_segment_report_module.c of elfutils (through v0.174) that can cause a denial of service (application crash) when processing a crafted ELF file. Connected advisories confirm the issue and indicate that upstream fixes exist in ...

CVE-2019-7664

CVE-2019-7664 affects elfutils 0.175: a negative-sized memcpy in libelf/note_xlate.h (elf_cvt_note) due to an incorrect overflow check can cause a segmentation fault and denial of service when processing crafted ELF input. Upstream fix is in elfutils 0.176; several advisories (Arch Linux ASA-2019...

CVE-2018-18521

The CVE-2018-18521 issue is a confirmed vulnerability in elfutils: a Divide-by-Zero in arlib_add_symbols() (arlib.c) when processing crafted ELF files, caused by a mishandled zero sh_entsize. This can lead to denial of service (application crash). Affected upstream releases prior to fix include e...

CVE-2018-16403

CVE-2018-16403 affects elfutils 0.173. The vulnerability is a heap-based buffer over-read in libdw, specifically in dwarf_getabbrev.c and dwarf_hasattr.c, which can lead to an application crash when processing crafted files. The issue is confirmed by multiple advisories (e.g., RHSA-2019:2197; ALA...

CVE-2017-7608

Technical details about CVE-2017-7608 are not publicly provided in the supplied Connected documents. The initial description notes a heap-based read in ebl_object_note_type_name but no further details or remediation in these sources.

CVE-2017-7611

CVE-2017-7611 affects Elfutils 0.168, where the check_symtab_shndx function in elflint.c is vulnerable to a heap-based buffer over-read via a crafted ELF file, leading to denial of service (application crash). The Connected documents also describe related ELF utils DoS variants (e.g., 2017-7612/7...

CVE-2017-7610

CVE-2017-7610 refers to a vulnerability in elfutils 0.168 where the check_group function in elflint.c can be triggered by a crafted ELF file to cause a heap-based buffer over-read and application crash. The initial description states the vulnerability and impact; no connected documents provide ad...

CVE-2017-7612

CVE-2017-7612 affects Elfutils (elflint.c) with a heap-based buffer over-read in check_sysv_hash, enabling a crafted ELF file to cause a denial of service (application crash). The connected IBM CVE list confirms the same root cause and impact framing for Elfutils; no additional product/version de...

CVE-2017-7613

CVE-2017-7613 affects Elfutils 0.168. The vulnerability arises from memory allocation failure in elflint.c when opening a crafted ELF file, leading to denial of service via memory exhaustion. Affected product: Elfutils (version 0.168). Root cause: insufficient validation of number of sections/seg...

CVE-2017-7607

CVE-2017-7607 affects the Elfutils project (readelf.c, handle_gnu_hash) with a vulnerability in elfutils 0.168 where a crafted ELF file can trigger a heap-based buffer over-read, causing an application crash. The Initial Description explicitly notes the crash vector via a crafted ELF file. Connec...

CVE-2017-7609

Technical details about CVE-2017-7609 are not publicly provided in the connected documents. Please monitor for updates from the source or vendor advisories to obtain affected products, impact, and remediation information.

CVE-2020-21047

CVE-2020-21047 affects elfutils’ libcpu (used by libasm, elfutils 0.177, git 47780c9e). It enables a denial-of-service via an out-of-bounds write (CWE-787), off-by-one error (CWE-193), and reachable assertion (CWE-617). Exploitation requires crafting ELF files that bypass bound checks. The vulner...

CVE-2019-7146

CVE-2019-7146 affects elfutils 0.175 where a buffer over-read in the ebl_object_note path (libebl) can be triggered by a crafted ELF file, enabling a denial-of-service as demonstrated by eu-readelf. The issue is rooted in reading ELF core/notes data without proper bounds checks. Public advisories...

CVE-2016-10255

Elfutils: CVE-2016-10255 affects the __libelf_set_rawdata_wrlock path in elf_getdata.c, where crafted sh_off/sh_size ELF header values can trigger a memory allocation failure and crash. This corresponds to memory allocation issues that enable a Denial of Service via a crafted ELF file. Affected p...

CVE-2016-10254

CVE-2016-10254 affects Elfutils. The vulnerability is due to memory allocation failure in allocate_elf (common.h), where crafting an ELF file can crash the program and cause a denial of service. The documents do not provide a remediation/patch details; only indicate Elfutils before 0.168 as affec...

CVE-2021-33294

The CVE-2021-33294 issue affects elfutils 0.183, with an infinite loop in handle_symtab (readelf.c) that allows a crafted file to trigger a denial of service. The Broadcom/IBM listings corroborate the infinite-loop DoS description. No public details on a fixed version are provided in the connecte...

CVE-2025-1377

CVE-2025-1377 affects GNU elfutils 0.192, specifically the function gelf_getsymshndx in eu-strip/strip.c. The vulnerability allows a local attacker to cause a denial of service. Several connected advisories confirm the same issue and cite the patch identifier fbf1df9ca286de3323ae541973b08449f8d03...

CVE-2025-1371

GNU elfutils 0.192 is affected via readelf.c in the eu-read handle_dynamic_symtab code path, where a null pointer dereference can occur with local attack access. The vulnerability is described as exploitable locally, and public exploits/ PoCs have been disclosed. A patch is available (commit/tag ...