Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-2226 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Binutils

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-190 — Integer Overflow or Wraparound CWE-122 — Heap-based Buffer Overflow17 documents9 sources

Severity

7.8HIGHNVD

EPSS

9.3%

top 7.23%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

GNU Binutils Valgrind

Timeline

PublishedFeb 24

Latest updateMay 17

Description

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debiangnu/binutils< 2.27.51.20161102-1+3

▶Ubuntuvalgrind/valgrind< 1:3.10.1-1ubuntu3~14.5+1

🔴Vulnerability Details

GHSA

GHSA-pcjp-97ph-pm6p: Integer overflow in the string_appends function in cplus-dem↗2022-05-17

▶

OSV

libiberty vulnerabilities↗2017-07-26

▶

OSV

valgrind vulnerabilities↗2017-06-21

▶

CVEList

CVE-2016-2226: Integer overflow in the string_appends function in cplus-dem↗2017-02-24

▶

OSV

CVE-2016-2226: Integer overflow in the string_appends function in cplus-dem↗2017-02-24

▶

💥Exploits & PoCs

Exploit-DB

GNU libiberty - Buffer Overflow↗2017-07-27

▶

📋Vendor Advisories

Ubuntu

GNU binutils vulnerabilities↗2021-07-21

▶

Ubuntu

gdb vulnerabilities↗2017-07-26

▶

Ubuntu

libiberty vulnerabilities↗2017-07-26

▶

Ubuntu

Valgrind vulnerabilities↗2017-06-21

▶

Red Hat

openjpeg2: Multiple security issues↗2016-10-27

▶

💬Community

Bugzilla

CVE-2016-2226 CVE-2016-4487 CVE-2016-4488 CVE-2016-4489 CVE-2016-4490 CVE-2016-4491 CVE-2016-4492 CVE-2016-4493 mingw-gcc: various flaws [epel-all]↗2016-05-05

▶

Bugzilla

CVE-2016-2226 CVE-2016-4487 CVE-2016-4488 CVE-2016-4489 CVE-2016-4490 CVE-2016-4491 CVE-2016-4492 CVE-2016-4493 msp430-gcc: various flaws [fedora-all]↗2016-05-05

▶

Bugzilla

CVE-2016-2226 gcc: Exploitable buffer overflow↗2016-05-05

▶