CVE-2025-1352

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada elfutils project elfutils. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

16 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.295960 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.495965 advisory pihak ketiga · vdb entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=32650 exploit · issue tracking
• https://sourceware.org/bugzilla/attachment.cgi?id=15923 broken link
• https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2 broken link
• https://vuldb.com/?ctiid.295960 permissions required · vdb entry
• https://www.gnu.org/ product
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html