libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer     dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file. (CVE-2015-8750)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several vulnerabilities were discovered in dwarfutils, a tool and library for reading/consuming and writing/producing DWARF debugging information. The Common Vulnerabilities and Exposures project identifies the following issues :

CVE-2015-8538

A specially crafted ELF file can cause a segmentation fault.

CVE-2015-8750

A specially crafted ELF file can cause a NULL pointer dereference.

CVE-2016-2050

Out-of-bounds write

CVE-2016-2091

Out-of-bounds read

CVE-2016-5034

Out-of-bounds write

CVE-2016-5036

Out-of-bounds read

CVE-2016-5038

Out-of-bounds read

CVE-2016-5039

Out-of-bounds read

CVE-2016-5042

A specially crafted DWARF section can cause an infinite loop, reading from increasing memory addresses until the application crashes.

For Debian 7 'Wheezy', these problems have been fixed in version 20120410-2+deb7u2.

We recommend that you upgrade your dwarfutils packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a NULL deference in dwarfutils, a tool to dump DWARF debug information from ELF objects.

For Debian 6 Squeeze, this issue has been fixed in dwarfutils version 20100214-1+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
219124	Linux Distros Unpatched Vulnerability : CVE-2015-8750	Nessus	Misc.	Local	medium
94143	Debian DLA-669-1 : dwarfutils security update	Nessus	Debian Local Security Checks	Local	high
87956	Debian DLA-388-1 : dwarfutils security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-8750

medium

Tenable Plugins

medium

high

medium