[gentoo-announce] [ GLSA 201710-10 ] elfutils: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201710-10 ] elfutils: Multiple vulnerabilities
Date:	Fri, 13 Oct 2017 22:34:11
Message-Id:	`1945425.Xbn1IEn9Lh@localhost.localdomain`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201710-10

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: elfutils: Multiple vulnerabilities

9

     Date: October 13, 2017

10

     Bugs: #614002, #614004, #618004

11

       ID: 201710-10

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in elfutils, the worst of

19

which may allow remote attackers to cause a Denial of Service

20

condition.

21

22

Background

23

==========

24

25

Elfutils provides a library and utilities to access, modify and analyse

26

ELF objects.

27

28

Affected packages

29

=================

30

31

    -------------------------------------------------------------------

32

     Package              /     Vulnerable     /            Unaffected

33

    -------------------------------------------------------------------

34

  1  dev-libs/elfutils           < 0.169-r1               >= 0.169-r1 

35

36

Description

37

===========

38

39

Multiple vulnerabilities have been discovered in elfutils. Please

40

review the referenced CVE identifiers for details.

41

42

Impact

43

======

44

45

A remote attacker could possibly cause a Denial of Service condition

46

via specially crafted ELF files.

47

48

Workaround

49

==========

50

51

There is no known workaround at this time.

52

53

Resolution

54

==========

55

56

All elfutils users should upgrade to the latest version:

57

58

  # emerge --sync

59

  # emerge --ask --oneshot --verbose ">=dev-libs/elfutils-0.169-r1"

60

61

Packages which depend on this library may need to be recompiled. Tools

62

such as revdep-rebuild may assist in identifying some of these

63

packages.

64

65

References

66

==========

67

68

[ 1 ] CVE-2016-10254

69

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10254

70

[ 2 ] CVE-2016-10255

71

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10255

72

[ 3 ] CVE-2017-7607

73

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7607

74

[ 4 ] CVE-2017-7608

75

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7608

76

[ 5 ] CVE-2017-7609

77

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7609

78

[ 6 ] CVE-2017-7610

79

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7610

80

[ 7 ] CVE-2017-7611

81

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7611

82

[ 8 ] CVE-2017-7612

83

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7612

84

[ 9 ] CVE-2017-7613

85

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7613

86

87

Availability

88

============

89

90

This GLSA and any updates to it are available for viewing at

91

the Gentoo Security Website:

92

93

 https://security.gentoo.org/glsa/201710-10

94

95

Concerns?

96

=========

97

98

Security is a primary focus of Gentoo Linux and ensuring the

99

confidentiality and security of our users' machines is of utmost

100

importance to us. Any security concerns should be addressed to

101

security@g.o or alternatively, you may file a bug at

102

https://bugs.gentoo.org.

103

104

License

105

=======

106

107

Copyright 2017 Gentoo Foundation, Inc; referenced text

108

belongs to its owner(s).

109

110

The contents of this document are licensed under the

111

Creative Commons - Attribution / Share Alike license.

112

113

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201710-10
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: elfutils: Multiple vulnerabilities
9	Date: October 13, 2017
10	Bugs: #614002, #614004, #618004
11	ID: 201710-10
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in elfutils, the worst of
19	which may allow remote attackers to cause a Denial of Service
20	condition.
21
22	Background
23	==========
24
25	Elfutils provides a library and utilities to access, modify and analyse
26	ELF objects.
27
28	Affected packages
29	=================
30
31	-------------------------------------------------------------------
32	Package / Vulnerable / Unaffected
33	-------------------------------------------------------------------
34	1 dev-libs/elfutils < 0.169-r1 >= 0.169-r1
35
36	Description
37	===========
38
39	Multiple vulnerabilities have been discovered in elfutils. Please
40	review the referenced CVE identifiers for details.
41
42	Impact
43	======
44
45	A remote attacker could possibly cause a Denial of Service condition
46	via specially crafted ELF files.
47
48	Workaround
49	==========
50
51	There is no known workaround at this time.
52
53	Resolution
54	==========
55
56	All elfutils users should upgrade to the latest version:
57
58	# emerge --sync
59	# emerge --ask --oneshot --verbose ">=dev-libs/elfutils-0.169-r1"
60
61	Packages which depend on this library may need to be recompiled. Tools
62	such as revdep-rebuild may assist in identifying some of these
63	packages.
64
65	References
66	==========
67
68	[ 1 ] CVE-2016-10254
69	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10254
70	[ 2 ] CVE-2016-10255
71	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10255
72	[ 3 ] CVE-2017-7607
73	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7607
74	[ 4 ] CVE-2017-7608
75	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7608
76	[ 5 ] CVE-2017-7609
77	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7609
78	[ 6 ] CVE-2017-7610
79	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7610
80	[ 7 ] CVE-2017-7611
81	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7611
82	[ 8 ] CVE-2017-7612
83	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7612
84	[ 9 ] CVE-2017-7613
85	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7613
86
87	Availability
88	============
89
90	This GLSA and any updates to it are available for viewing at
91	the Gentoo Security Website:
92
93	https://security.gentoo.org/glsa/201710-10
94
95	Concerns?
96	=========
97
98	Security is a primary focus of Gentoo Linux and ensuring the
99	confidentiality and security of our users' machines is of utmost
100	importance to us. Any security concerns should be addressed to
101	security@g.o or alternatively, you may file a bug at
102	https://bugs.gentoo.org.
103
104	License
105	=======
106
107	Copyright 2017 Gentoo Foundation, Inc; referenced text
108	belongs to its owner(s).
109
110	The contents of this document are licensed under the
111	Creative Commons - Attribution / Share Alike license.
112
113	http://creativecommons.org/licenses/by-sa/2.5