QID 671063

Elfutils is a collection of utilities, including stack (to show backtraces), nm (for listing symbols from object files), size (for listing the section sizes of an object or archive file),strip (for discarding symbols), readelf (to see the raw elf file structures), and elflint (to check for well-formed elf files).
security fix(es): an invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174.
The vulnerability allows attackers to cause a denial of service (application crash) with a crafted elf file, as demonstrated by consider_notes.(cve-2018-18310) an invalid memory address dereference exists in the function elf_end in libelf in elfutils through v0.174.
Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries.
The vulnerability allows attackers to cause a denial of service (application crash) with a crafted elf file.(cve-2018-18520) divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted elf file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.(cve-2018-18521) an attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174.
Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception.
Note: the maintainers believe this is not a real issue, but instead a "warning caused by asan because the allocation is big.
"(cve-2019-7148)

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.