CVE-2018-8769
elfutils: buffer over-read in ebldynamictagname.c:ebl_dynamic_tag_name() allows for denial of service
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · March 18, 2018
Updated · November 22, 2025
Description
An out-of-bound read flaw has been found in elfutils in the ebl_dynamic_tag_name function of ebldynamictagname.c file. An attacker could exploit this by supplying a crafted ELF file to display wrong data or potentially cause a crash in eu-readelf and eu-elflint binaries.
Statement
This issue did not affect the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the vulnerable commit.
This issue did not affect the versions of elfutils as shipped with Red Hat Developer Toolset 6 and 7 as they did not include the vulnerable commit.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 4.4CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-125 · Out-of-bounds Read