CVE-2024-25260

Publication date 20 February 2024

Last updated 24 March 2025

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

No security impact per upstream elfutils developers

Status

Show unmaintained releases

Package	Ubuntu Release	Status
elfutils	24.10 oracular	Not affected
	24.04 LTS noble	Fixed 0.190-1.1ubuntu0.1
	23.10 mantic	Ignored end of life, was needs-triage
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

per the bug, upstream does not consider this issue to have a security impact, lowering priority to low

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
elfutils	Upstream: https://sourceware.org/git/?p=elfutils.git;a=commit;h=373f5212677235fc3ca6068b887111554790f944