CVE-2025-1377
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192.
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
- CVSS 4.0
- 4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-404
- Affected
- elfutils project/elfutils
- Source
- cna@vuldb.com
References
- https://sourceware.org/bugzilla/attachment.cgi?id=15941Exploit
- https://sourceware.org/bugzilla/show_bug.cgi?id=32673Exploit, Issue Tracking
- https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2Exploit, Issue Tracking
- https://vuldb.com/?ctiid.295985Permissions Required, VDB Entry
- https://vuldb.com/?id.295985Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.497539Third Party Advisory, VDB Entry
- https://www.gnu.org/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.