CVE-2018-16403
elfutils: libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and...
CVE-2018-16403 is fixed in 4 products on 1 platform, first by elfutils 0.170-0.4ubuntu0.1, released February 8, 2019. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0112
66th percentile
libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| elfutils · Ubuntu 18.04.6 LTS (bionic) | 0.170-0.4ubuntu0.1 | elfutils 0.170-0.4ubuntu0.1 | Feb 8, 2019 |
| libasm1 · Ubuntu 18.04.6 LTS (bionic) | 0.170-0.4ubuntu0.1 | libasm1 0.170-0.4ubuntu0.1 | Feb 8, 2019 |
| libdw1 · Ubuntu 18.04.6 LTS (bionic) | 0.170-0.4ubuntu0.1 | libdw1 0.170-0.4ubuntu0.1 | Feb 8, 2019 |
| libelf1 · Ubuntu 18.04.6 LTS (bionic) | 0.170-0.4ubuntu0.1 | libelf1 0.170-0.4ubuntu0.1 | Feb 8, 2019 |