PublicDateAtUSN: 2017-04-09
Candidate: CVE-2017-7610
PublicDate: 2017-04-09 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7610
 https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c/
 https://ubuntu.com/security/notices/USN-3670-1
Description:
 The check_group function in elflint.c in elfutils 0.168 allows remote
 attackers to cause a denial of service (heap-based buffer over-read and
 application crash) via a crafted ELF file.
Ubuntu-Description:
Notes:
Bugs:
 https://sourceware.org/bugzilla/show_bug.cgi?id=21320
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=859993
Priority: medium
Discovered-by: Agostino Sarubbo
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [5.5 MEDIUM]

Patches_elfutils:
 upstream: https://sourceware.org/git/?p=elfutils.git;a=commitdiff;h=fb6709f1a41b58a9557ea45b7f53ae678c660b21
upstream_elfutils: needed
precise_elfutils: ignored (reached end-of-life)
precise/esm_elfutils: ignored (end of ESM support, was needed)
trusty_elfutils: released (0.158-0ubuntu5.3)
trusty/esm_elfutils: released (0.158-0ubuntu5.3)
vivid/stable-phone-overlay_elfutils: ignored (reached end-of-life)
vivid/ubuntu-core_elfutils: DNE
xenial_elfutils: released (0.165-3ubuntu1.1)
esm-infra/xenial_elfutils: released (0.165-3ubuntu1.1)
yakkety_elfutils: ignored (reached end-of-life)
zesty_elfutils: ignored (reached end-of-life)
artful_elfutils: released (0.170-0.1)
bionic_elfutils: released (0.170-0.4)
cosmic_elfutils: released (0.170-0.4)
disco_elfutils: released (0.170-0.4)
eoan_elfutils: released (0.170-0.4)
focal_elfutils: released (0.170-0.4)
groovy_elfutils: released (0.170-0.4)
hirsute_elfutils: released (0.170-0.4)
devel_elfutils: released (0.170-0.4)