Log in Start free

Vulnerability · Published Feb 16, 2025 · Assigned by VulDB

CVE-2025-1365GNU elfutils eu-readelf readelf.c process_symtab buffer overflow

Medium 5.3

In plain English

A medium-severity buffer overflow in elfutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 71.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12elfutilsno fix listedDEBIAN-CVE-2025-1365
Debian:13elfutilsno fix listedDEBIAN-CVE-2025-1365
Debian:14elfutilsno fix listedDEBIAN-CVE-2025-1365
Ubuntu:22.04:LTSelfutils0.186-1ubuntu0.1USN-7369-1
Ubuntu:24.04:LTSelfutils0.190-1.1ubuntu0.1USN-7369-1
Ubuntu:24.04:LTSelfutils0.190-1.1ubuntu0.1UBUNTU-CVE-2025-1365

Affected products (as reported)

VendorProductVersions
GNU elfutils 0.192

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References