Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-9998: libdwarf can crash from crafted files

CVE-2017-9998 · published 9 years ago

Summary

A routine inside libdwarf can cause the program to stop working when it reads a specially crafted DWARF file. This can be used by an attacker to make the service unavailable. Update libdwarf to the latest version or apply the provided patch, and avoid processing untrusted DWARF files until then.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
libdwarf_project	libdwarf	>= 1999-12-14, <= 2017-06-28 `cpe:2.3:a:libdwarf_project:libdwarf::::::::`

Original advisory text

The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

References

http://www.securityfocus.com/bid/99310 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1465756 Exploit Issue Tracking Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published28 Jun 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-9998 · NVD

Track software like this

Free during beta