CVE-2024-25260

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

• CVE-2024-25260: out-of-bounds global read in arm_machine_flag_name() when an ARM ELF header carries an EABI version byte greater than 5
• CVE-2025-1376: NULL pointer dereference in elf_strptr() on a string section that has sh_size set but no data read yet
• CVE-2025-1377: NULL pointer dereference in eu-strip's remove_debug_relocations() when a relocation section's sh_link references an SHT_NOBITS section

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c. (CVE-2024-25260) GNU elfutils eu-readelf readelf.c print_string_section buffer overflow. (CVE-2025-1372) GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service. (CVE-2025-1377)

Root has patched CVE-2024-25260 in the elfutils package for Root:Debian:12. Multiple fixed versions available.

It was discovered that readelf from elfutils could be made to read out of bounds. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-25260)

It was discovered that readelf from elfutils could be made to write out of bounds. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1365)

It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1371)

It was discovered that readelf from elfutils could be made to dereference invalid memory. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service. (CVE-2025-1372)

It was discovered that strip from elfutils could be made to dereference invalid memory. If a user or automated system were tricked into running strip on a specially crafted file, an attacker could cause strip to crash, resulting in a denial of service. (CVE-2025-1377)