Chromium: Vulnerability reported in elfutils |
|||
Issue descriptionAutomated analysis has detected that the following third party packages have had vulnerabilities publicly reported. NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package. Package Name: elfutils Package Version: [cpe:/a:elfutils_project:elfutils:0.158] Advisory: CVE-2018-16062 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2018-16062 CVSS severity score: 4.3/10.0 Confidence: high Description: dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
,
Oct 30
That's right, elfutils isn't shipped AFAIK, in fact I don't think it is used at all any longer. Adding digit@ in case he know's differently. If so, I'm going to remove this from Chromium entirely.
,
Nov 1
I don't know of any use case for elfutils in Chrome these days, so please remove it if you can.
,
Nov 2
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/061bff2de674893db5be68d08344a41bebab80a7 commit 061bff2de674893db5be68d08344a41bebab80a7 Author: Ross McIlroy <rmcilroy@chromium.org> Date: Fri Nov 02 11:27:30 2018 Remove libelf from src/third_party. No longer used by relocation packing tool, now that Android supports packed relocations within NDK. BUG= chromium:899208 Change-Id: Ife3d46e98846430b65c4f5cb79f8e2bbb20e6b2a Reviewed-on: https://chromium-review.googlesource.com/c/1307498 Reviewed-by: David Turner <digit@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#604890} [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/BUILD.gn [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/OWNERS [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/README.chromium [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/README.security [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/clang.patch [delete] https://crrev.com/4c5496274240356e0f6325c04aca69fce7c855b6/third_party/elfutils/config.h
,
Nov 2
|
|||
►
Sign in to add a comment |
|||
Comment 1 by och...@chromium.org
, Oct 29Owner: rmcilroy@chromium.org