CVE-2019-7664

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

Score

CVSS 3.1 5.5 Medium

Status

Modified - cve@mitre.org

Published

2019-02-09

Last modified

2024-08-04

Weaknesses

CWE-787

Affected products

• Elfutils (Elfutils Project)
• Enterprise Linux (Redhat)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux Eus (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Server Aus (Redhat)
• Enterprise Linux Server Tus (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• https://access.redhat.com/errata/RHSA-2019:2197
• https://access.redhat.com/errata/RHSA-2019:3575
• https://sourceware.org/bugzilla/show_bug.cgi?id=24084