{"affected":[{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf-devel":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libasm-devel":"0.158-7.7.2","libdw-devel":"0.158-7.7.2","libebl-devel":"0.158-7.7.2","libelf-devel":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libasm-devel":"0.158-7.7.2","libdw-devel":"0.158-7.7.2","libebl-devel":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libasm1-32bit":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libasm1-32bit":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libasm1-32bit":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf-devel":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"elfutils":"0.158-7.7.2","libasm1":"0.158-7.7.2","libasm1-32bit":"0.158-7.7.2","libdw1":"0.158-7.7.2","libdw1-32bit":"0.158-7.7.2","libebl1":"0.158-7.7.2","libebl1-32bit":"0.158-7.7.2","libelf-devel":"0.158-7.7.2","libelf1":"0.158-7.7.2","libelf1-32bit":"0.158-7.7.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","name":"elfutils","purl":"pkg:rpm/suse/elfutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.158-7.7.2"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for elfutils fixes the following issues:\n\nSecurity issues fixed: \t  \n\n- CVE-2018-16403: Fixed a heap-based buffer over-read that could have led to Denial of Service (bsc#1107067).  \n- CVE-2016-10254: Fixed a memory allocation failure in alloxate_elf (bsc#1030472).\n- CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (bsc#1125007).\n- CVE-2016-10255: Fixed a memory allocation failure in libelf_set_rawdata_wrlock (bsc#1030476).\n- CVE-2019-7150: Added a missing check in dwfl_segment_report_module which could have allowed truncated files \n  to be read (bsc#1123685).\n- CVE-2018-16062: Fixed a heap-buffer-overflow (bsc#1106390).\n- CVE-2017-7611: Fixed a heap-based buffer over-read that could have led to Denial of Service (bsc#1033088).\n- CVE-2017-7613: Fixed denial of service caused by the missing validation of the number of sections \n  and the number of segments in a crafted ELF file (bsc#1033090).\n- CVE-2017-7607: Fixed a heap-based buffer overflow in handle_gnu_hash (bsc#1033084).\n- CVE-2017-7608: Fixed a heap-based buffer overflow in ebl_object_note_type_name() (bsc#1033085).\n- CVE-2017-7610: Fixed a heap-based buffer overflow in check_group (bsc#1033087).\n- CVE-2018-18521: Fixed multiple divide-by-zero vulnerabilities in function arlib_add_symbols() (bsc#1112723).\n- CVE-2017-7612: Fixed a denial of service in check_sysv_hash() via a crafted ELF file (bsc#1033089).\n- CVE-2018-18310: Fixed an invalid address read in dwfl_segment_report_module.c (bsc#1111973).\n- CVE-2018-18520: Fixed bad handling of ar files inside are files (bsc#1112726).\n","id":"SUSE-SU-2019:1733-1","modified":"2019-07-03T11:54:57Z","published":"2019-07-03T11:54:57Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191733-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1030472"},{"type":"REPORT","url":"https://bugzilla.suse.com/1030476"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033084"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033085"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033087"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033088"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033089"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033090"},{"type":"REPORT","url":"https://bugzilla.suse.com/1106390"},{"type":"REPORT","url":"https://bugzilla.suse.com/1107067"},{"type":"REPORT","url":"https://bugzilla.suse.com/1111973"},{"type":"REPORT","url":"https://bugzilla.suse.com/1112723"},{"type":"REPORT","url":"https://bugzilla.suse.com/1112726"},{"type":"REPORT","url":"https://bugzilla.suse.com/1123685"},{"type":"REPORT","url":"https://bugzilla.suse.com/1125007"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10255"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7607"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7608"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7610"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7611"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7612"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-7613"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-16062"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-16403"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18310"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18520"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18521"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-7150"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-7665"}],"related":["CVE-2016-10254","CVE-2016-10255","CVE-2017-7607","CVE-2017-7608","CVE-2017-7610","CVE-2017-7611","CVE-2017-7612","CVE-2017-7613","CVE-2018-16062","CVE-2018-16403","CVE-2018-18310","CVE-2018-18520","CVE-2018-18521","CVE-2019-7150","CVE-2019-7665"],"summary":"Security update for elfutils","upstream":["CVE-2016-10254","CVE-2016-10255","CVE-2017-7607","CVE-2017-7608","CVE-2017-7610","CVE-2017-7611","CVE-2017-7612","CVE-2017-7613","CVE-2018-16062","CVE-2018-16403","CVE-2018-18310","CVE-2018-18520","CVE-2018-18521","CVE-2019-7150","CVE-2019-7665"]}