CVE-2020-35448: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can…

PriorityP411low3.3CVSS 3.1

AVLACLPRNUIRSUCLINAN

EPSS

1.27%

66.9th percentile

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	binutils	< binutils 2.37-3 (bookworm)	binutils 2.37-3 (bookworm)
gnu	binutils	—	—
gnu	binutils	>= 0 < 2.37-3	2.37-3
gnu	binutils	>= 0 < 2.37-3	2.37-3
gnu	binutils	>= 0 < 2.37-3	2.37-3

CVSS provenance

nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

osv3.3LOW

vendor_debian3.3LOW

vendor_redhat3.3LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.