远程 Oracle Linux 8 主机上安装的程序包受到 ELSA-2019-3575 公告中提及的多个漏洞的影响。

  - 在 elfutils 0.175 中，在 libelf 的 elf32_xlatetom.c 的函数 elf32_xlatetom 中发现基于堆的缓冲区过度读取。构建的 ELF 输入可造成分段错误，导致拒绝服务（程序崩溃），原因在于 ebl_core_note 未拒绝畸形核心文件说明。(CVE-2019-7665)

  - 在 elfutils 0.175 中，libdw 中 dwarf_getsrclines.c 的 read_srclines 函数中发现基于堆的缓冲区过度读取漏洞。攻击者可通过构造的输入造成分段错误，从而导致拒绝服务，eu-nm 即是一例。(CVE-2019-7149)

  - 在 elfutils 0.175 中发现了一个问题。libelf/elf32_xlatetom.c 中的函数 elf64_xlatetom 中存在分段错误，原因在于 dwfl_segment_report_module 未检查从核心文件读取 dyn 数据是否被截断。构建的输入可造成程序崩溃，导致拒绝服务，eu-stack 即为一例。(CVE-2019-7150)

  - 在 elfutils 0.175 中，由于溢出检查错误，libelf/note_xlate.h 的 elf_cvt_note 中会尝试执行大小为负值的 memcpy。攻击者可通过构造的 elf 输入造成分段错误，从而导致拒绝服务（程序崩溃）。(CVE-2019-7664)

  - 在 elfutils 0.175 中，在 libebl 的 eblobjnote.c 的 ebl_object_note 函数中存在缓冲区过度读取。
    远程攻击者可利用此漏洞，通过构造的 elf 文件，造成拒绝服务，eu-readelf 即为一例。(CVE-2019-7146)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

elfutils 更新现可用于 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有低等安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。elfutils 程序包含有数个与建立和维护可执行代码相关的实用工具与库。下列程序包已升级到更高的上游版本：elfutils (0.176)。(BZ#1676504) 安全修复：* elfutils：在 libdw/ dwarf_getaranges.c:dwarf_getaranges() 中，通过特制的文件可导致基于堆的缓冲区过度读取 (CVE-2018-16062) * elfutils：在特制的 ELF 中，因为双重解压缩段导致双重释放，进而造成崩溃 (CVE-2018-16402) * elfutils：libdw/dwarf_getabbrev.c 和 libwd/ dwarf_hasattr.c 中的基于堆的缓冲区过度读取造成崩溃 (CVE-2018-16403) * elfutils：在 libdwfl 的 dwfl_segment_report_module.c 中发现无效的内存地址取消引用 (CVE-2018-18310) * elfutils：eu-size 无法处理递归的 ar 文件 (CVE-2018-18520) * elfutils：arlib.c 的 arlib_add_symbols 函数中发现除零错误 (CVE-2018-18521) * elfutils：在 libdw 中，dwarf_getsrclines.c 的 read_srclines 内发生基于堆的缓冲区过度读取 (CVE-2019-7149) * elfutils：libelf/elf32_xlatetom.c 的 elf64_xlatetom 中发生分段错误 (CVE-2019-7150) * elfutils：elf_cvt_note in libelf/note_xlate.h 中存在越界写入 (CVE-2019-7664) * elfutils：elf32_xlatetom.c 内的 elf32_xlatetom 函数中存在基于堆的缓冲区过度读取 (CVE-2019-7665) 有关此安全问题的详细信息，包括其影响、CVSS 分数、致谢和其他相关信息，请参阅列于“参考”部分的 CVE 页面。更多变更：如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.7 发行说明。

远程主机上安装的 AOS 版本低于 5.11.2。因此，其受到 NXSA-AOS-5.11.2 公告中提及的多个漏洞影响。

  - Gnome Pango 1.42 及更高版本受到下列因素影响：缓冲区溢出。影响为：基于堆的缓冲区溢出可用来执行代码。组件为：函数名称：pango_log2vis_get_embedding_levels，nchars 和无限循环的任务。攻击向量为：当应用程序向 pango_itemize 等函数传递无效 utf-8 字符串时，可使用该错误。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 验证码中的缓冲区溢出漏洞影响。内部函数 Curl_ntlm_core_mk_nt_hash 会将密码长度乘以二 (SUM) 以计算从堆配置的临时存储区域大小。长度值之后会用来逐一循环访问密码，并在分配的存储缓冲区中生成输出。在具有 32 位 size_t 的系统上，当密码长度超过 2GB (2^31 个字节) 时，计算 SUM 的数学会触发整数溢出。此整数溢出通常会造成实际分配非常小的缓冲区，而不是预期非常大的缓冲区，进而利用该缓冲区结束堆缓冲区溢出。（此错误与 CVE-2017-8816 基本相同。）(CVE-2018-14618)

  - 在 libX11 1.6.5 及之前所有版本中，在 ListExt.c 的 XListExtensions 中发现一个问题。恶意服务器可发送首个字符串溢出的回复，造成变量设置为空，随后又将其释放，从而导致段错误和拒绝服务。(CVE-2018-14598)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数容易受到由恶意服务器响应导致的大小差一错误影响，从而导致 DoS 或可能造成其他不明影响。(CVE-2018-14599)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数会将变量解释为已签名，而非未签名，这可造成越界写入（最多 128 个字节），从而导致拒绝服务或远程代码执行。(CVE-2018-14600)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has elfutils packages installed that are affected by multiple vulnerabilities:

  - dwarf_getaranges in dwarf_getaranges.c in libdw in     elfutils before 2018-08-18 allows remote attackers to     cause a denial of service (heap-based buffer over-read)     via a crafted file. (CVE-2018-16062)

  - libelf/elf_end.c in elfutils 0.173 allows remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact because it tries to decompress twice.
    (CVE-2018-16402)

  - libdw in elfutils 0.173 checks the end of the attributes     list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c     and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-     based buffer over-read and an application crash.
    (CVE-2018-16403)

  - A heap-based buffer over-read was discovered in the     function read_srclines in dwarf_getsrclines.c in libdw     in elfutils 0.175. A crafted input can cause     segmentation faults, leading to denial-of-service, as     demonstrated by eu-nm. (CVE-2019-7149)

  - An issue was discovered in elfutils 0.175. A     segmentation fault can occur in the function     elf64_xlatetom in libelf/elf32_xlatetom.c, due to     dwfl_segment_report_module not checking whether the dyn     data read from a core file is truncated. A crafted input     can cause a program crash, leading to denial-of-service,     as demonstrated by eu-stack. (CVE-2019-7150)

  - An Invalid Memory Address Dereference exists in the     function elf_end in libelf in elfutils through v0.174.
    Although eu-size is intended to support ar files inside     ar files, handle_ar in size.c closes the outer ar file     before handling all inner entries. The vulnerability     allows attackers to cause a denial of service     (application crash) with a crafted ELF file.
    (CVE-2018-18520)

  - Divide-by-zero vulnerabilities in the function     arlib_add_symbols() in arlib.c in elfutils 0.174 allow     remote attackers to cause a denial of service     (application crash) with a crafted ELF file, as     demonstrated by eu-ranlib, because a zero sh_entsize is     mishandled. (CVE-2018-18521)

  - An invalid memory address dereference was discovered in     dwfl_segment_report_module.c in libdwfl in elfutils     through v0.174. The vulnerability allows attackers to     cause a denial of service (application crash) with a     crafted ELF file, as demonstrated by consider_notes.
    (CVE-2018-18310)

  - In elfutils 0.175, a heap-based buffer over-read was     discovered in the function elf32_xlatetom in     elf32_xlatetom.c in libelf. A crafted ELF input can     cause a segmentation fault leading to denial of service     (program crash) because ebl_core_note does not reject     malformed core file notes. (CVE-2019-7665)

  - In elfutils 0.175, a negative-sized memcpy is attempted     in elf_cvt_note in libelf/note_xlate.h because of an     incorrect overflow check. Crafted elf input causes a     segmentation fault, leading to denial of service     (program crash). (CVE-2019-7664)

  - In elfutils 0.175, there is a buffer over-read in the     ebl_object_note function in eblobjnote.c in libebl.
    Remote attackers could leverage this vulnerability to     cause a denial-of-service via a crafted elf file, as     demonstrated by eu-readelf. (CVE-2019-7146)

  - **DISPUTED** An attempted excessive memory allocation     was discovered in the function read_long_names in     elf_begin.c in libelf in elfutils 0.174. Remote     attackers could leverage this vulnerability to cause a     denial-of-service via crafted elf input, which leads to     an out-of-memory exception. NOTE: The maintainers     believe this is not a real issue, but instead a warning     caused by ASAN because the allocation is big. By setting     ASAN_OPTIONS=allocator_may_return_null=1 and running the     reproducer, nothing happens. (CVE-2019-7148)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for elfutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The elfutils packages contain a number of utility programs and libraries related to the creation and maintenance of executable code.

The following packages have been upgraded to a later upstream version:
elfutils (0.176). (BZ#1676504)

Security Fix(es) :

* elfutils: Heap-based buffer over-read in libdw/ dwarf_getaranges.c:dwarf_getaranges() via crafted file (CVE-2018-16062)

* elfutils: Double-free due to double decompression of sections in crafted ELF causes crash (CVE-2018-16402)

* elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/ dwarf_hasattr.c causes crash (CVE-2018-16403)

* elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl (CVE-2018-18310)

* elfutils: eu-size cannot handle recursive ar files (CVE-2018-18520)

* elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c (CVE-2018-18521)

* elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw (CVE-2019-7149)

* elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c (CVE-2019-7150)

* elfutils: Out of bound write in elf_cvt_note in libelf/note_xlate.h (CVE-2019-7664)

* elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c (CVE-2019-7665)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3575 advisory.

    [0.176-5]
    - Add elfutils-0.176-strip-symbols-illformed.patch

    [0.176-4]
    - Add elfutils-0.176-elf-update.patch (#1717349)

    [0.176-3]
    - Rebuilt for annobin change.

    [0.176-2]
    - Add elfutils-0.176-xlate-note.patch (#1705138)

    [0.176-1]
    - New upstream release.
      - backends: riscv improved core file and return value location support.
      - Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,               CVE-2019-7664, CVE-2019-7665.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0041 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-7146:
    In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl.
    Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as     demonstrated by eu-readelf.

    CVE-2019-7149:
    A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw     in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as     demonstrated by eu-nm.

    CVE-2019-7150:
    An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom     in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from     a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as     demonstrated by eu-stack.

    CVE-2019-7664:
    In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of     an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service     (program crash).

    CVE-2019-7665:
    In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in     elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of     service (program crash) because ebl_core_note does not reject malformed core file notes.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180659	Oracle Linux 8：elfutils (ELSA-2019-3575)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	medium
128375	CentOS 7：elfutils (CESA-2019:2197)	Nessus	CentOS Local Security Checks	2019/8/30	2024/4/30	critical
164608	Nutanix AOS：多个漏洞 (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
132468	NewStart CGSL CORE 5.05 / MAIN 5.05 : elfutils Multiple Vulnerabilities (NS-SA-2019-0258)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	critical
128375	CentOS 7 : elfutils (CESA-2019:2197)	Nessus	CentOS Local Security Checks	2019/8/30	2024/4/30	critical
180659	Oracle Linux 8 : elfutils (ELSA-2019-3575)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	medium
238530	TencentOS Server 3: elfutils (TSSA-2022:0041)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

medium

critical

critical

critical

critical

medium

medium

critical