CVE-2016-8681
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows...
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
CVE-2016-8681- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
CVE-2016-8681- Updated
- 2026-11-02
EUVDEUVD-2016-9520 No score
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
EUVD-2016-9520- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxmj-7hrr-mwh2
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows...
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
GHSA-pxmj-7hrr-mwh2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVAZL-33326
CVE-2016-8681 affecting package libdwarf for versions less than 0.9.0
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
AZL-33326- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-42084
CVE-2016-8681 affecting package libdwarf for versions less than 0.9.0-1
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
AZL-42084- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
CVE-2016-8681- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-8681
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
DEBIAN-CVE-2016-8681- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-8681
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
- Record
UBUNTU-CVE-2016-8681- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libdwarfAzure Linux:2 |
before 0.9.0 | 0.9.0 |
libdwarfAzure Linux:3 |
before 0.9.0-1 | 0.9.0-1 |
dwarfutilsDebian:12 |
before 20161001-2 | 20161001-2 |
dwarfutilsDebian:13 |
before 20161001-2 | 20161001-2 |
dwarfutilsDebian:14 |
before 20161001-2 | 20161001-2 |
dwarfutilsUbuntu:16.04:LTS |
All versions, plus listed versions 20120410-220120410-2+deb7u2build0.16.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-8681 is a medium vulnerability (CVSS 5.5) in Libdwarf Project Libdwarf, published February 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in libdwarf 0.9.0.
References
openwall.com/lists/oss-security/2016/10/16/5
securityfocus.com/bid/93592
blogs.gentoo.org/ago/2016/10/06/libdwarf-heap-based-buffer-overflow-in-_dwarf_get_abbrev_for_code-dwarf_util-c-2
bugzilla.redhat.com/show_bug.cgi?id=1385690
nvd.nist.gov/vuln/detail/CVE-2016-8681
github.com/advisories/GHSA-pxmj-7hrr-mwh2
Show 6 moreShow less
security-tracker.debian.org/tracker/CVE-2016-8681
ubuntu.com/security/CVE-2016-8681
sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f3792964c46214f
cve.org/CVERecord?id=CVE-2016-8681