USN-7369-1: elfutils vulnerabilities
Ubuntu ServerCanonical
Update from:USN-7369-1: elfutils vulnerabilities
24 March 2025
Several security issues were fixed in elfutils.
Releases
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Packages
elfutils - collection of utilities to handle ELF objects
Details
It was discovered that readelf from elfutils could be made to read out of
bounds. If a user or automated system were tricked into running readelf
on a specially crafted file, an attacker could cause readelf to crash,
resulting in a denial of service. This issue only affected Ubuntu 24.04
LTS. (CVE-2024-25260)
It was discovered that readelf from elfutils could be made to write out of
bounds. If a user or automated system were tricked into running readelf
on a specially crafted file, an attacker could cause readelf to crash,
resulting in a denial of service, or possibly execute arbitrary code.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1365)
It was discovered that readelf from elfutils could be made to dereference
invalid memory. If a user or automated system were tricked into running
readelf on a specially crafted file, an attacker could cause readelf to
crash, resulting in a denial of service. This issue only affected Ubuntu
24.04 LTS and Ubuntu 24.10. (CVE-2025-1371)
It was discovered that readelf from elfutils could be made to dereference
invalid memory. If a user or automated system were tricked into running
readelf on a specially crafted file, an attacker could cause readelf to
crash, resulting in a denial of service. (CVE-2025-1372)
It was discovered that strip from elfutils could be made to dereference
invalid memory. If a user or automated system were tricked into running
strip on a specially crafted file, an attacker could cause strip to
crash, resulting in a denial of service. (CVE-2025-1377)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.10
- elfutils - 0.191-2ubuntu0.1
Ubuntu 24.04 - elfutils - 0.190-1.1ubuntu0.1
Ubuntu 22.04 - elfutils - 0.186-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
