CVE-2014-0172: elfutils_project elfutils Numeric Errors
Vulnerability summary
CVE-2014-0172 is a medium (CVSS 6.8) Numeric Errors vulnerability in elfutils_project elfutils. EPSS estimates a 4.03% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 11-04-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.03%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 4.03% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- elfutils< 0:0.160-1.el7
- elfutils-debuginfo< 0:0.160-1.el7
- elfutils-devel< 0:0.160-1.el7
- elfutils-devel-static< 0:0.160-1.el7
- elfutils-libelf< 0:0.160-1.el7
Mageia2 products
- elfutils< 0.155-2.1.mga3
- elfutils< 0.157-3.1.mga4
Debian1 product
- elfutils< 0.158-1
Elfutils_project1 product
- elfutils0.153 | 0.154 | 0.155 | 0.156 | 0.157 | 0.158
Ubuntu1 product
- elfutils< 0.158-0ubuntu5.1
5 vendors · 13 products
References
17 links- lists.fedorahosted.org/pipermail/elfutils-devel/2014-April/003921.htmlMailing ListX Refsource MLISTPatch
