FEDORA-2018-32c8599fe1 — security update for elfutils

stable

elfutils-0.174-1.fc29

FEDORA-2018-32c8599fe1 created by mjw 4 years ago for Fedora 29

Fixes CVE-2018-16062, CVE-2018-16402 and CVE-2018-16403. unstrip: Handle SHT_GROUP sections. strip: Handle mixed (out of order) allocated/non-allocated sections. elfcompress: Don't rewrite input file if no section data needs updating. Try harder to keep same file mode bits (suid) on rewrite. libelf, libdw and all tools now handle extended shnum and shstrndx correctly.

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2018-32c8599fe1

This update has been submitted for testing by mjw.

4 years ago

This update has been pushed to testing.

4 years ago

cserpentis commented & provided feedback 4 years ago

karma

works for me

pwalter commented & provided feedback 4 years ago

karma

Works

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

4 years ago

This update has been submitted for batched by mjw.

4 years ago

This update has been submitted for stable by bodhi.

4 years ago

This update has been pushed to stable.

4 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

elfutils-0.174-1.fc29

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

4 years ago

in testing

4 years ago

in stable

4 years ago

BZ#1608390 eu-strip might corrupted section header table

BZ#1623752 CVE-2018-16062 elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file

BZ#1623753 CVE-2018-16062 elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file [fedora-all]

BZ#1625050 CVE-2018-16402 elfutils: Double-free due to double decompression of sections in crafted ELF causes crash

BZ#1625051 CVE-2018-16402 elfutils: Double-free due to double decompression of sections in crafted ELF causes crash [fedora-all]

BZ#1625055 CVE-2018-16403 elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash

BZ#1625056 CVE-2018-16403 elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash [fedora-all]

elfutils-0.174-1.fc29

Automated Test Results

ignored