CVE-2016-5038
HighSummary
The dwarf_get_macro_startend_file function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to system downtime.
Recommendation
It is recommended to update libdwarf to version 20160923 or later to mitigate this vulnerability.
Other vulnerabilities in libdwarf
See all- CVE-2016-5041High
The dwarf_macro5.c file in libdwarf before version 20160923 contains a vulnerability that allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 without a DW_AT_name.
- CVE-2016-9276High
The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before version 20161124 allows remote attackers to cause a denial of service via an out-of-bounds read.
- CVE-2016-9275High
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before version 20161124 can be exploited by remote attackers.
- CVE-2016-5044High
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
- CVE-2016-5043High
The dwarf_dealloc function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
- CVE-2016-5042High
The dwarf_get_aranges_list function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
- CVE-2016-5040High
libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
- CVE-2016-5039High
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
- CVE-2016-5036High
The dump_block function in print_sections.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
- CVE-2017-9055Critical
An issue, also known as DW201703-001, was discovered in libdwarf in the function dwarf_formsdata(). A few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
Original NVD description (English source)
The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.