CVE-2014-0172

Name	CVE-2014-0172
Description	Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	744017

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
elfutils (PTS)	buster	0.176-1.1	fixed
	bullseye	0.183-1	fixed
	bookworm, sid	0.188-2.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
elfutils	source	squeeze	(not affected)
elfutils	source	wheezy	(not affected)
elfutils	source	(unstable)	0.158-1	low	744017

[squeeze] - elfutils <not-affected> (Affected code introduced in 0.153)
[wheezy] - elfutils <not-affected> (Affected code introduced in 0.153)