Libdwarf CVE-2017-9052 Local Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	98553
Class:	Boundary Condition Error
CVE:	CVE-2017-9052
Remote:	No
Local:	Yes
Published:	Mar 21 2017 12:00AM
Updated:	Mar 21 2017 12:00AM
Credit:	Marcel Bohme and Van-Thuan Pham
Vulnerable:	libdwarf Project libdwarf 2017-03-21
Not Vulnerable:

Libdwarf CVE-2017-9052 Local Heap Based Buffer Overflow Vulnerability

Libdwarf is prone to a local heap-based buffer overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to cause denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

Libdwarf CVE-2017-9052 Local Heap Based Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Libdwarf CVE-2017-9052 Local Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Libdwarf CVE-2017-9052 Local Heap Based Buffer Overflow Vulnerability

References:

• David A's DWARF vulnerabilities (Prevanders)
  
• libdwarf Home Page (libdwarf)
  
• Bug 1452587 - (CVE-2017-9052) CVE-2017-9052 libdwarf: heap-based buffer over-rea (Redhat)
  
• CVE-2017-9052 (Redhat)