CVE-2024-2002
dwarfutils: A double-free vulnerability was found in libdwarf
CVE-2024-2002 is fixed in 8 products on 1 platform, first by DEBIAN-CVE-2024-2002, released March 18, 2024. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0109
65th percentile
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dwarfutils · Debian 13.5 (trixie) | 1:0.11.1-1 | DEBIAN-CVE-2024-2002 | Mar 18, 2024 |
| dwarfutils · Debian 14 | 1:0.11.1-1 | DEBIAN-CVE-2024-2002 | Mar 18, 2024 |
| libdwarf · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-debuginfo · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-debugsource · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-devel · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-static · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-tools · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |
| libdwarf-tools-debuginfo · amzn 2023 | 1:0.5.0-1.amzn2023.0.3 | ALAS2023-2024-579 | Mar 27, 2024 |