Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

libdwarf can read beyond memory, risking crashes

CVE-2017-9055 · published 9 years ago
Summary

The libdwarf library may read past its allocated memory when handling certain data types, which can cause application crashes or expose data. This occurs because the code does not verify that the data is within expected limits. Update to the latest patched version of libdwarf or apply the vendor's recommended fix to resolve the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
libdwarf_project libdwarf 2017-03-21
cpe:2.3:a:libdwarf_project:libdwarf:2017-03-21:*:*:*:*:*:*:*
Original advisory text
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published18 May 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-9055 · NVD
Track software like this
Free during beta