CVE-2020-35507
published 2021-01-04CVE-2020-35507: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.23%
65.9th percentile
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | < binutils 2.33.50.20200107-1 (bookworm) | binutils 2.33.50.20200107-1 (bookworm) |
| gnu | binutils | < 2.34 | 2.34 |
| gnu | binutils | — | — |
| gnu | binutils | >= 0 < 2.33.50.20200107-1 | 2.33.50.20200107-1 |
| gnu | binutils | >= 0 < 2.33.50.20200107-1 | 2.33.50.20200107-1 |
| gnu | binutils | >= 0 < 2.33.50.20200107-1 | 2.33.50.20200107-1 |
| gnu | binutils | >= 0 < 2.33.50.20200107-1 | 2.33.50.20200107-1 |
| msrc | cm1_binutils_2.32-5_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-87mc-cvfv-8r2w: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef
ghsa_unreviewed·2022-05-24
CVE-2020-35507 [MEDIUM] CWE-476 GHSA-87mc-cvfv-8r2w: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.
OSV
CVE-2020-35507: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef
osv·2021-01-04·CVSS 5.5
CVE-2020-35507 [MEDIUM] CVE-2020-35507: There's a flaw in bfd_pef_parse_function_stubs of bfd/pef
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Microsoft
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause
vendor_msrc·2021-01-12·CVSS 5.5
CVE-2020-35507 [MEDIUM] CWE-476 There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog
Debian
CVE-2020-35507: binutils - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versi...
vendor_debian·2020·CVSS 5.5
CVE-2020-35507 [MEDIUM] CVE-2020-35507: binutils - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versi...
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Scope: local
bookworm: resolved (fixed in 2.33.50.20200107-1)
bullseye: resolved (fixed in 2.33.50.20200107-1)
forky: resolved (fixed in 2.33.50.20200107-1)
sid: resolved (fixed in 2.33.50.20200107-1)
trixie: resolved (fixed in 2.33.50.20200107-1)
Red Hat
binutils: NULL pointer dereference in bfd_pef_parse_function_stubs function in bfd/pef.c
vendor_redhat·2019-12-22·CVSS 5.5
CVE-2020-35507 [MEDIUM] CWE-476 binutils: NULL pointer dereference in bfd_pef_parse_function_stubs function in bfd/pef.c
binutils: NULL pointer dereference in bfd_pef_parse_function_stubs function in bfd/pef.c
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
A flaw was found in bfd_pef_parse_function_stubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Statement: binutils as shipped with Red Hat Enterprise Linux 8's GCC Toolset 10 and Red Hat Developer Toolset 10 are not affected by this flaw b
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-04
Published