CVE-2014-0172
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used...
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
CVE-2014-0172- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
CVE-2014-0172- Updated
- 2026-11-02
EUVDEUVD-2014-0225 No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
EUVD-2014-0225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6c9-79p5-7pgm No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used...
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
GHSA-q6c9-79p5-7pgm- Updated
- 2026-11-02
OSV No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
CVE-2014-0172- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0172 No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2014-0172- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0177 No score
Updated elfutils package fixes CVE-2014-0172
Updated elfutils packages fix security vulnerability:
The libdw library provides support for accessing DWARF debugging information inside ELF files. An integer overflow flaw in check_section(), leading to a heap-based buffer overflow, was found in the libdw library. A malicious ELF file could cause an application using libdw (such as eu-readelf) to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2014-0172).
- Record
MGASA-2014-0177- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10570-1 No score
elfutils-0.167-1.5 on GA media
These are all security issues fixed in the elfutils-0.167-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10570-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0172 No score
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
- Record
UBUNTU-CVE-2014-0172- Updated
- 2026-11-02
OSVUSN-2188-1 No score
elfutils vulnerability
Florian Weimer discovered that the elfutils libdw library incorrectly handled malformed compressed debug sections in ELF files. If a user or automated system were tricked into processing a specially crafted ELF file, applications linked against libdw could be made to crash, or possibly execute arbitrary code.
- Record
USN-2188-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
elfutilsDebian:12 |
before 0.158-1 | 0.158-1 |
elfutilsDebian:13 |
before 0.158-1 | 0.158-1 |
elfutilsDebian:14 |
before 0.158-1 | 0.158-1 |
elfutilsMageia:3 |
before 0.155-2.1.mga3 | 0.155-2.1.mga3 |
elfutilsMageia:4 |
before 0.157-3.1.mga4 | 0.157-3.1.mga4 |
elfutils-debuginfoRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-develRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-devel-staticRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-develRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-devel-staticRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
elfutilsRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelfRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libsRed Hat:enterprise_linux:7::client |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-develRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-devel-staticRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-develRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-devel-staticRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutilsRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelfRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libsRed Hat:enterprise_linux:7::computenode |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-debuginfoRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-devel-staticRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-devel-staticRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutilsRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-develRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelfRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-develRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libsRed Hat:enterprise_linux:7::server |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-devel-staticRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-devel-staticRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutilsRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-develRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelfRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libelf-develRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutils-libsRed Hat:enterprise_linux:7::workstation |
before 0:0.160-1.el7 | 0:0.160-1.el7 |
elfutilsUbuntu:14.04:LTS |
before 0.158-0ubuntu5.1, plus listed versions 0.157-1ubuntu10.158-0ubuntu30.158-0ubuntu40.158-0ubuntu5 |
0.158-0ubuntu5.1 |
elfutilsopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.167-1.5 | 0.167-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0172 is a medium vulnerability (CVSS 6.8) in Elfutils Project Elfutils, published April 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in elfutils 0.158-1.
References
seclists.org/oss-sec/2014/q2/54
lists.fedorahosted.org/pipermail/elfutils-devel/2014-April/003921.html
security.gentoo.org/glsa/201612-32
securityfocus.com/bid/66714
bugzilla.redhat.com/show_bug.cgi?id=1085663
ubuntu.com/usn/USN-2188-1
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-0172
github.com/advisories/GHSA-q6c9-79p5-7pgm
security-tracker.debian.org/tracker/CVE-2014-0172
advisories.mageia.org/MGASA-2014-0177.html
bugs.mageia.org/show_bug.cgi?id=13181
access.redhat.com/errata/RHEA-2015:0369
security.access.redhat.com/data/csaf/v2/advisories/2015/rhea-2015_0369.json
cve.org/CVERecord?id=CVE-2014-0172
ubuntu.com/security/CVE-2014-0172
suse.com/security/cve/CVE-2014-0172