Stay Secure with the Latest Linux Advisories

security advisorysecurity issuebug fix

Red Hat Enterprise Linux 7: RHSA-2019-2197-01 Low: elfutils Security Fix

An update for elfutils is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: elfutils security, bug fix, and enhancement update Advisory ID: RHSA-2019:2197-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2197 Issue date: 2019-08-06 CVE Names: CVE-2018-16062 CVE-2018-16402 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7149 CVE-2019-7150 CVE-2019-7664 CVE-2019-7665 ==================================================================== 1. Summary: An update for elfutils is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The elfutils packages contain a number of utility programs and libraries related to the creation and maintenance ofexecutable code. The following packages have been upgraded to a later upstream version: elfutils (0.176). (BZ#1676504) Security Fix(es): * elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file (CVE-2018-16062) * elfutils: Double-free due to double decompression of sections in crafted ELF causes crash (CVE-2018-16402) * elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash (CVE-2018-16403) * elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl (CVE-2018-18310) * elfutils: eu-size cannot handle recursive ar files (CVE-2018-18520) * elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c (CVE-2018-18521) * elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw (CVE-2019-7149) * elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c (CVE-2019-7150) * elfutils: Out of bound write in elf_cvt_note in libelf/note_xlate.h (CVE-2019-7664) * elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c (CVE-2019-7665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1623752 - CVE-2018-16062 elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file 1625050 - CVE-2018-16402 elfutils: Double-free due to double decompression of sections in crafted ELF causes crash 1625055 - CVE-2018-16403 elfutils: Heap-based buffer over-read inlibdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash 1642604 - CVE-2018-18310 elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl 1646477 - CVE-2018-18520 elfutils: eu-size cannot handle recursive ar files 1646482 - CVE-2018-18521 elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c 1671443 - CVE-2019-7149 elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw 1671446 - CVE-2019-7150 elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c 1677536 - CVE-2019-7664 elfutils: Out of bound write in elf_cvt_note in libelf/note_xlate.h 1677538 - CVE-2019-7665 elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c 1704754 - elfutils xlate (cross-endian) functions might not convert an ELF Note header 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: elfutils-0.176-2.el7.src.rpm noarch: elfutils-default-yama-scope-0.176-2.el7.noarch.rpm x86_64: elfutils-0.176-2.el7.x86_64.rpm elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-libelf-0.176-2.el7.i686.rpm elfutils-libelf-0.176-2.el7.x86_64.rpm elfutils-libs-0.176-2.el7.i686.rpm elfutils-libs-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-0.176-2.el7.i686.rpm elfutils-devel-0.176-2.el7.x86_64.rpm elfutils-devel-static-0.176-2.el7.i686.rpm elfutils-devel-static-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-0.176-2.el7.i686.rpm elfutils-libelf-devel-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-static-0.176-2.el7.i686.rpm elfutils-libelf-devel-static-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v.7): Source: elfutils-0.176-2.el7.src.rpm noarch: elfutils-default-yama-scope-0.176-2.el7.noarch.rpm x86_64: elfutils-0.176-2.el7.x86_64.rpm elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-libelf-0.176-2.el7.i686.rpm elfutils-libelf-0.176-2.el7.x86_64.rpm elfutils-libs-0.176-2.el7.i686.rpm elfutils-libs-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-0.176-2.el7.i686.rpm elfutils-devel-0.176-2.el7.x86_64.rpm elfutils-devel-static-0.176-2.el7.i686.rpm elfutils-devel-static-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-0.176-2.el7.i686.rpm elfutils-libelf-devel-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-static-0.176-2.el7.i686.rpm elfutils-libelf-devel-static-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux Server (v.7): Source: elfutils-0.176-2.el7.src.rpm noarch: elfutils-default-yama-scope-0.176-2.el7.noarch.rpm ppc64: elfutils-0.176-2.el7.ppc64.rpm elfutils-debuginfo-0.176-2.el7.ppc.rpm elfutils-debuginfo-0.176-2.el7.ppc64.rpm elfutils-devel-0.176-2.el7.ppc.rpm elfutils-devel-0.176-2.el7.ppc64.rpm elfutils-libelf-0.176-2.el7.ppc.rpm elfutils-libelf-0.176-2.el7.ppc64.rpm elfutils-libelf-devel-0.176-2.el7.ppc.rpm elfutils-libelf-devel-0.176-2.el7.ppc64.rpm elfutils-libs-0.176-2.el7.ppc.rpm elfutils-libs-0.176-2.el7.ppc64.rpm ppc64le: elfutils-0.176-2.el7.ppc64le.rpm elfutils-debuginfo-0.176-2.el7.ppc64le.rpm elfutils-devel-0.176-2.el7.ppc64le.rpm elfutils-libelf-0.176-2.el7.ppc64le.rpm elfutils-libelf-devel-0.176-2.el7.ppc64le.rpm elfutils-libs-0.176-2.el7.ppc64le.rpm s390x: elfutils-0.176-2.el7.s390x.rpm elfutils-debuginfo-0.176-2.el7.s390.rpm elfutils-debuginfo-0.176-2.el7.s390x.rpm elfutils-devel-0.176-2.el7.s390.rpm elfutils-devel-0.176-2.el7.s390x.rpm elfutils-libelf-0.176-2.el7.s390.rpm elfutils-libelf-0.176-2.el7.s390x.rpm elfutils-libelf-devel-0.176-2.el7.s390.rpm elfutils-libelf-devel-0.176-2.el7.s390x.rpm elfutils-libs-0.176-2.el7.s390.rpm elfutils-libs-0.176-2.el7.s390x.rpm x86_64: elfutils-0.176-2.el7.x86_64.rpm elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-0.176-2.el7.i686.rpm elfutils-devel-0.176-2.el7.x86_64.rpm elfutils-libelf-0.176-2.el7.i686.rpm elfutils-libelf-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-0.176-2.el7.i686.rpm elfutils-libelf-devel-0.176-2.el7.x86_64.rpm elfutils-libs-0.176-2.el7.i686.rpm elfutils-libs-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v.7): ppc64: elfutils-debuginfo-0.176-2.el7.ppc.rpm elfutils-debuginfo-0.176-2.el7.ppc64.rpm elfutils-devel-static-0.176-2.el7.ppc.rpm elfutils-devel-static-0.176-2.el7.ppc64.rpm elfutils-libelf-devel-static-0.176-2.el7.ppc.rpm elfutils-libelf-devel-static-0.176-2.el7.ppc64.rpm ppc64le: elfutils-debuginfo-0.176-2.el7.ppc64le.rpm elfutils-devel-static-0.176-2.el7.ppc64le.rpm elfutils-libelf-devel-static-0.176-2.el7.ppc64le.rpm s390x: elfutils-debuginfo-0.176-2.el7.s390.rpm elfutils-debuginfo-0.176-2.el7.s390x.rpm elfutils-devel-static-0.176-2.el7.s390.rpm elfutils-devel-static-0.176-2.el7.s390x.rpm elfutils-libelf-devel-static-0.176-2.el7.s390.rpm elfutils-libelf-devel-static-0.176-2.el7.s390x.rpm x86_64: elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-static-0.176-2.el7.i686.rpm elfutils-devel-static-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-static-0.176-2.el7.i686.rpm elfutils-libelf-devel-static-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: elfutils-0.176-2.el7.src.rpm noarch: elfutils-default-yama-scope-0.176-2.el7.noarch.rpm x86_64: elfutils-0.176-2.el7.x86_64.rpm elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-0.176-2.el7.i686.rpm elfutils-devel-0.176-2.el7.x86_64.rpm elfutils-libelf-0.176-2.el7.i686.rpm elfutils-libelf-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-0.176-2.el7.i686.rpm elfutils-libelf-devel-0.176-2.el7.x86_64.rpm elfutils-libs-0.176-2.el7.i686.rpm elfutils-libs-0.176-2.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: elfutils-debuginfo-0.176-2.el7.i686.rpm elfutils-debuginfo-0.176-2.el7.x86_64.rpm elfutils-devel-static-0.176-2.el7.i686.rpm elfutils-devel-static-0.176-2.el7.x86_64.rpm elfutils-libelf-devel-static-0.176-2.el7.i686.rpm elfutils-libelf-devel-static-0.176-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-16062 https://access.redhat.com/security/cve/CVE-2018-16402 https://access.redhat.com/security/cve/CVE-2018-16403 https://access.redhat.com/security/cve/CVE-2018-18310 https://access.redhat.com/security/cve/CVE-2018-18520 https://access.redhat.com/security/cve/CVE-2018-18521 https://access.redhat.com/security/cve/CVE-2019-7149 https://access.redhat.com/security/cve/CVE-2019-7150 https://access.redhat.com/security/cve/CVE-2019-7664 https://access.redhat.com/security/cve/CVE-2019-7665 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXUl3qtzjgjWX9erEAQj3ORAAhg86S45ctlnwL4Me7VDFUT4nymzdVHJt FAZUZVHPkslvxLNCi0zdsfpDEvXcQNr78kDDq2+357ZYmgx6XvOhPONWjVjPDqY+ J+MaKkCzfDU7a48AGg5SlTwnWNWTgIvcVE3/P8WQZa7EIUAEFw7ceRCyoQMhRSnI 11lOO59NPpCCFWXa6KiACsin5Pgr7+770jQSVhJYqvhZPvpUnCMTR9ypkgUlGV9B Ex28M711yz8ew0stBMNJ9gTYJmuvh0mebN4kfCKJUSa13lekbJ8aa/Bp9EWuYO0n g4N1xvnQkEdktc1mgm/MqFRLyz57aEKMuF8xZnTRTd3qYuGfQFPR492SmJ4VMMGx lb/6shLaAXDnjaPPJlWE1+oy25apFjACnQ8ky3A1w3PNpE5ETO0HVZcFmJMIeH+I ozgwy5rK/DoAB8f7vPL7W4ZlRYe498itBBZUIJV1fI/wDSKE/mVcy/b1oTm/lDCu T2D4qeJfpY9VGaEKEuFf7+5ZXSQM3andxQxFMYOBaLghow1ZIx3M80kQgBtdjSqP a6uTkxWrs6uFO82/8r2fZedSMsgiinH36uVXbVSJVhrwluFap44LLEt+PsPyIE0Y GTfroM3A6eArVEJzUkOZcVGSKHrsOozNjmRnx+/fFPGCo6VjxkY4zKPZauB9+aTg TH73WCGXpoA=4I1u -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat launched a minimal-adjustment elfutils update focused on resolving security concerns and implementing bug resolutions. Discover comprehensive information here.. Red Hat, elfutils, security advisory, bug fix, enterprise linux. . Severity: Low.LinuxSecurity.com Team

Aug 06, 2019 •Low Red Hat