Log in Start free

Vulnerability · Published Feb 17, 2025 · Assigned by VulDB

CVE-2025-1376GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service

Low 2.5

In plain English

A low-severity security flaw in elfutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.3%top 76.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12elfutilsno fix listedDEBIAN-CVE-2025-1376
Debian:13elfutilsno fix listedDEBIAN-CVE-2025-1376
Debian:14elfutilsno fix listedDEBIAN-CVE-2025-1376
Ubuntu:22.04:LTSelfutilsno fix listedUBUNTU-CVE-2025-1376
Ubuntu:24.04:LTSelfutilsno fix listedUBUNTU-CVE-2025-1376
Ubuntu:25.10elfutilsno fix listedUBUNTU-CVE-2025-1376
Ubuntu:26.10elfutilsno fix listedUBUNTU-CVE-2025-1376

Affected products (as reported)

VendorProductVersions
GNU elfutils 0.192

Weakness: CWE-404 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References