A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the
    function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the
    argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has
    been disclosed to the public and may be used. The identifier of the patch is
    5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1365)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765289483 advisory.

  - A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability     affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The     manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The     complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been     disclosed to the public and may be used. The name of the patch is     2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1352)

  - A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the     function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the     argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has     been disclosed to the public and may be used. The identifier of the patch is     5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1365)

  - A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this     vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the     component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be     approached locally. The exploit has been disclosed to the public and may be used. The identifier of the     patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1372)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765289483 advisory.

  - A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability     affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The     manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The     complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been     disclosed to the public and may be used. The name of the patch is     2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1352)

  - A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the     function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the     argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has     been disclosed to the public and may be used. The identifier of the patch is     5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1365)

  - A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this     vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the     component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be     approached locally. The exploit has been disclosed to the public and may be used. The identifier of the     patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1372)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the elfutils package has been released.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:1011-1 advisory.

    golang-github-QubitProducts-exporter_exporter:

    - Non-customer-facing optimization and update

    golang-github-boynux-squid_exporter:

    - Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):

      * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path.
      * Added TLS and Basic Authentication to the exporters web interface.
      * Added support for the exporter to authenticate against the Squid proxy itself.
      * Allow the gathering of process information without requiring root privileges
      * The exporter can now be configured using environment variables
      * Added support for custom labels to all exported metrics for better data filtering.
      * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors     occurred.
      * Added 'service time' metrics to analyze proxy speed and performance.
      * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks.
      * Corrected the squid_client_http_requests_total metric to ensure accurate reporting.

    golang-github-lusitaniae-apache_exporter:

    - Version update from 1.0.8 to 1.0.10:

      * Updated github.com/prometheus/client_golang to 1.21.1
      * Updated github.com/prometheus/common to 0.63.0
      * Updated github.com/prometheus/exporter-toolkit to 0.14.0
      * Fixed signal handler logging
      * Migrated logging to log/slog

    golang-github-prometheus-alertmanager:

    - Non-customer-facing optimization and update

    golang-github-prometheus-node_exporter:

    - Non-customer-facing optimization and update

    golang-github-prometheus-promu:

    - Non-customer-facing optimization and update

    spacecmd:

    - Version 5.0.15-0
      * Fix typo in spacecmd help ca-cert flag (bsc#1253174)
      * Convert cached IDs to int (bsc#1251995)
      * Fix spacecmd binary file upload (bsc#1253659)

    uyuni-tools:

    - Version 0.1.38-0
      * Fix cobbler config migration to standalone files (bsc#1256803)
      * Detect custom apache and squid config in the /etc/uyuni/proxy         folder
      * Add ssh tuning to configure sshd (bsc#1253738)
      * Ignore supportconfig errors (bsc#1255781)
      * Bump the default image tag to 5.0.7
      * Remove cgroup mount for podman containers (bsc#1253347)
      * Registry flag can be a string (bsc#1254589)
      * Use static supportconfig name to avoid dynamic search         (bsc#1257941)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the     function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the     argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has     been disclosed to the public and may be used. The identifier of the patch is     5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
    (CVE-2025-1365)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7369-1 advisory.

    It was discovered that readelf from elfutils could be made to read out of bounds. If a user or automated     system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to     crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-25260)

    It was discovered that readelf from elfutils could be made to write out of bounds. If a user or automated     system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1365)

    It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running readelf on a specially crafted file, an attacker could cause     readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu     24.10. (CVE-2025-1371)

    It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running readelf on a specially crafted file, an attacker could cause     readelf to crash, resulting in a denial of service. (CVE-2025-1372)

    It was discovered that strip from elfutils could be made to dereference invalid memory. If a user or     automated system were tricked into running strip on a specially crafted file, an attacker could cause     strip to crash, resulting in a denial of service. (CVE-2025-1377)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460164	Echo: elfutils: security update to 0.192-4+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460164	Echo: elfutils: security update to 0.192-4+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
453711	Google: dev-libs/elfutils: security update to 19115.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
453711	Google: dev-libs/elfutils: security update to 19115.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
452972	Google: dev-libs/elfutils: security update to 17800.519.40	Tenable Cloud Security	Google COS Security Checks	Local	medium
452972	Google: dev-libs/elfutils: security update to 17800.519.40	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
362263	Rocky Linux 9.6 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765289483)	Nessus	Rocky Linux Local Security Checks	Local	medium
361555	AlmaLinux 9.6 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765289483)	Nessus	Alma Linux Local Security Checks	Local	medium
333697	Photon OS 5.0: Elfutils PHSA-2025-5.0-91-0488	Nessus	PhotonOS Local Security Checks	Local	medium
332314	Photon OS 5.0: Elfutils PHSA-2025-5.0-92-0488	Nessus	PhotonOS Local Security Checks	Local	medium
303775	SUSE SLES12 : Security update 5.0.7 for Multi-Linux Manager Client Tools (SUSE-SU-2026:1011-1)	Nessus	SuSE Local Security Checks	Local	medium
258499	Linux Distros Unpatched Vulnerability : CVE-2025-1365	Nessus	Misc.	Local	medium
233317	Photon OS 5.0: Elfutils PHSA-2025-5.0-0488	Nessus	PhotonOS Local Security Checks	Local	medium
233299	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : elfutils vulnerabilities (USN-7369-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-1365

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium