CVE-2018-18520

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174

published October 19, 2018

CVSS
—
EPSS
3%
Percentile
86.3
In the wild
Unconfirmed
What it is

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02791 · 86.3th percentile
Published
2018-10-19T17:00Z
EPSS history
Timeline
  • 19 OCT 17:00Z
    An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174
    cvelistv5