Libdwarf Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-39170 libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.High 8.8 · Sep 1, 2022
• CVE-2022-34299 There is a heap-based buffer over-read in libdwarf 0.4.0.High 8.1 · Jun 23, 2022
• CVE-2022-32200 libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c.High 7.8 · Jun 2, 2022
• CVE-2017-9055 An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21.Critical 9.8 · May 18, 2017
• CVE-2017-9054 An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21.Critical 9.8 · May 18, 2017
• CVE-2017-9053 An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21.Critical 9.1 · May 18, 2017
• CVE-2017-9052 An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21.Critical 9.8 · May 18, 2017
• CVE-2016-5041 dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry usiHigh 7.5 · Apr 10, 2017
• CVE-2016-9276 The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).High 7.5 · Mar 23, 2017
• CVE-2016-9275 Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial ofHigh 7.5 · Mar 23, 2017
• CVE-2016-9558 (1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit patterCritical 9.8 · Feb 28, 2017
• CVE-2016-5044 The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and craHigh 7.5 · Feb 17, 2017
• CVE-2016-5043 The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF sHigh 7.5 · Feb 17, 2017
• CVE-2016-5042 The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWAHigh 7.5 · Feb 17, 2017
• CVE-2016-5040 libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit headHigh 7.5 · Feb 17, 2017
• CVE-2016-5039 The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-High 7.5 · Feb 17, 2017
• CVE-2016-5038 The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds reaHigh 7.5 · Feb 17, 2017
• CVE-2016-5036 The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frHigh 7.5 · Feb 17, 2017
• CVE-2016-9480 libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approachCritical 9.1 · Nov 29, 2016