elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at
    readelf.c. (CVE-2024-25260)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787242456 advisory.

  - elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at     readelf.c. (CVE-2024-25260)

  - A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the     function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads     to denial of service. It is possible to launch the attack on the local host. The complexity of an attack     is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and     may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply     a patch to fix this issue. (CVE-2025-1376)

  - A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue     affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation     leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to     the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is     recommended to apply a patch to fix this issue. (CVE-2025-1377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has elfutils packages installed that are affected by a vulnerability:

  - elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at     readelf.c. (CVE-2024-25260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0168 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-25260:
    elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at     readelf.c.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7369-1 advisory.

    It was discovered that readelf from elfutils could be made to read out of bounds. If a user or automated     system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to     crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-25260)

    It was discovered that readelf from elfutils could be made to write out of bounds. If a user or automated     system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1365)

    It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running readelf on a specially crafted file, an attacker could cause     readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu     24.10. (CVE-2025-1371)

    It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running readelf on a specially crafted file, an attacker could cause     readelf to crash, resulting in a denial of service. (CVE-2025-1372)

    It was discovered that strip from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running strip on a specially crafted file, an attacker could cause     strip to crash, resulting in a denial of service. (CVE-2025-1377)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at     readelf.c. (CVE-2024-25260)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464058	Echo: elfutils: security update to 0.188-2.1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464058	Echo: elfutils: security update to 0.188-2.1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
361126	AlmaLinux 9.2 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787242456)	Nessus	Alma Linux Local Security Checks	Local	medium
242834	NewStart CGSL MAIN 7.02 : elfutils Vulnerability (NS-SA-2025-0126)	Nessus	NewStart CGSL Local Security Checks	Local	medium
238533	TencentOS Server 4: elfutils (TSSA-2024:0168)	Nessus	Tencent Local Security Checks	Local	medium
233299	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : elfutils vulnerabilities (USN-7369-1)	Nessus	Ubuntu Local Security Checks	Local	medium
227773	Linux Distros Unpatched Vulnerability : CVE-2024-25260	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2024-25260

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium