CVE-2016-9275
HighSummary
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before version 20161124 can be exploited by remote attackers.
Risk Assessment
An attacker can cause a denial of service by triggering an out-of-bounds read, leading to application unavailability.
Recommendation
It is recommended to update Libdwarf to version 20161124 or later to mitigate this vulnerability.
Other vulnerabilities in Libdwarf
See all- CVE-2016-5041High
The dwarf_macro5.c file in libdwarf before version 20160923 contains a vulnerability that allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 without a DW_AT_name.
- CVE-2016-9276High
The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before version 20161124 allows remote attackers to cause a denial of service via an out-of-bounds read.
- CVE-2016-5044High
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
- CVE-2016-5043High
The dwarf_dealloc function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
- CVE-2016-5042High
The dwarf_get_aranges_list function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
- CVE-2016-5040High
libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
- CVE-2016-5039High
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
- CVE-2016-5038High
The dwarf_get_macro_startend_file function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
- CVE-2016-5036High
The dump_block function in print_sections.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
- CVE-2017-9055Critical
An issue, also known as DW201703-001, was discovered in libdwarf in the function dwarf_formsdata(). A few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
Original NVD description (English source)
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).