CVE-2022-38533 — Out-of-bounds Write in Binutils
Severity
5.5MEDIUMNVD
OSV8.8
EPSS
0.0%
top 91.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 26
Latest updateDec 11
Description
In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages3 packages
Also affects: Fedora 36, 37
Patches
🔴Vulnerability Details
4📋Vendor Advisories
5Red Hat▶
binutils: heap-based buffer overflow in bfd_getl32() when called by strip_main() in objcopy.c via a crafted file↗2022-08-13
Microsoft▶
In GNU Binutils before 2.40 there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.↗2022-08-09
Debian▶
CVE-2022-38533: binutils - In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error functi...↗2022