CVE-2016-5039

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/05/24/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/25/1Exploit, Mailing List, Third Party Advisory
https://www.prevanders.net/dwarfbug.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2016/05/24/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/25/1Exploit, Mailing List, Third Party Advisory
https://www.prevanders.net/dwarfbug.htmlThird Party Advisory, VDB Entry

Timeline

Published: Feb 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50407.5libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a c CVE-2016-50417.5dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging i CVE-2016-50427.5The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and cras CVE-2016-50437.5The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) v CVE-2016-50447.5The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-CVE-2016-50458.1NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering se CVE-2016-50476.5NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors.CVE-2016-50489.8SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the us CVE-2016-50497.5Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot CVE-2016-50509.8Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading CVE-2016-50517.5OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.CVE-2016-50527.5OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.