Detections
Analytics

Google: dev-libs/elfutils: security update to 19115.0.0

medium Tenable Self-Hosted Container Security Plugin ID 453791

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this
 vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the
 component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be
 approached locally. The exploit has been disclosed to the public and may be used. The identifier of the
 patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
 (CVE-2025-1372)

Solution

Update the dev-libs/elfutils library and its related packages to version 19115.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 453791

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.27

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2025-1372

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/17/2025

Reference Information

CVE: CVE-2025-1372