Red Hat Security AdvisoryRHSA-2020:1471
elfutils security update
Released 2020-04-14 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) elfutils-0.172-4.el7_6, elfutils-default-yama-scope-0.172-4.el7_6, elfutils-libelf-0.172-4.el7_6 +1
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) elfutils-devel-0.172-4.el7_6, elfutils-devel-static-0.172-4.el7_6, elfutils-libelf-devel-0.172-4.el7_6 +1
- Red Hat Enterprise Linux Server EUS (v. 7.6) elfutils-0.172-4.el7_6, elfutils-default-yama-scope-0.172-4.el7_6, elfutils-devel-0.172-4.el7_6 +7
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) elfutils-devel-static-0.172-4.el7_6, elfutils-devel-static-0.172-4.el7_6.ppc, elfutils-libelf-devel-static-0.172-4.el7_6 +1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) elfutils-0.172-4.el7_6, elfutils-default-yama-scope-0.172-4.el7_6, elfutils-devel-0.172-4.el7_6 +3
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) elfutils-devel-static-0.172-4.el7_6, elfutils-libelf-devel-static-0.172-4.el7_6
Fixes 1 record
Priority MEDIUM 48
libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03691 · Published 2018-09-03 · Partial fix CWE-415
