The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) via a crafted file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libdwarf: heap-based buffer over-read in dwarf_formsdata() (CVE-2017-9055)

  - Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote     attackers to cause a denial of service (program crash) via a crafted ELF file. (CVE-2014-9482)

  - dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV). (CVE-2015-8538)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Update to 20161001 upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 20160929 upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198610	RHEL 7 : libdwarf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
94841	Fedora 25 : libdwarf (2016-9b8717537a)	Nessus	Fedora Local Security Checks	medium
93918	Fedora 24 : libdwarf (2016-328754be1c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-7410

medium

Tenable Plugins

critical

medium

medium