Debian Binutils vulnerabilities

CVE-2018-7569 [MEDIUM] CVE-2018-7569: binutils - dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distribute... dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. Scope: local bookworm: resolved (fixed in 2.30-6) bullseye: resolved (fixed in 2.30

CVE-2018-7568 [MEDIUM] CVE-2018-7568: binutils - The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (... The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm. Scope: local bookworm: resolved (fixed in 2.30-6) bullseye: resol

CVE-2018-7570 [MEDIUM] CVE-2018-7570: binutils - The assign_file_positions_for_non_load_sections function in elf.c in the Binary ... The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy. Sco

CVE-2018-6872 [MEDIUM] CVE-2018-6872: binutils - The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) librar... The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment. Scope: local bookworm: resolved (fixed in 2.30-4) bullseye: resolved (fixed in 2.30-4) forky: reso

CVE-2018-6759 [MEDIUM] CVE-2018-6759: binutils - The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor... The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file. Scope: local bookworm: resolved (fixed in 2.30-3) bullseye:

CVE-2018-10372 [MEDIUM] CVE-2018-10372: binutils - process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to c... process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf. Scope: local bookworm: resolved (fixed in 2.30.90.20180627-1) bullseye: resolved (fixed in 2.30.90.20180627-1) forky: resolved (fixed in 2.30.90.20180627

CVE-2018-20673 [MEDIUM] CVE-2018-20673: binutils - The demangle_template function in cplus-dem.c in GNU libiberty, as distributed i... The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2018-20712 [MEDIUM] CVE-2018-20712: binutils - A heap-based buffer over-read exists in the function d_expression_1 in cp-demang... A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2018-12934 [HIGH] CVE-2018-12934: binutils - remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2... remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.20190707-1) forky: resolved (fixed in 2.32.51.20190707-1) sid: resolved

CVE-2018-12697 [HIGH] CVE-2018-12697: binutils - A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was disc... A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.20190707-1) forky: resolved (fixed in 2.

CVE-2018-19931 [HIGH] CVE-2018-19931: binutils - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd)... An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.2019070

CVE-2018-18605 [MEDIUM] CVE-2018-18605: binutils - A heap-based buffer over-read issue was discovered in the function sec_merge_has... A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of serv

CVE-2018-18607 [MEDIUM] CVE-2018-18607: binutils - An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File De... An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstra

CVE-2018-12699 [CRITICAL] CVE-2018-12699: binutils - finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial o... finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.2019

CVE-2018-12698 [HIGH] CVE-2018-12698: binutils - demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutil... demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fix

CVE-2018-9996 [MEDIUM] CVE-2018-9996: binutils - An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU B... An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: ope

CVE-2018-17985 [MEDIUM] CVE-2018-17985: binutils - An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU... An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.20190

CVE-2018-17360 [MEDIUM] CVE-2018-17360: binutils - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd)... An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. Scope: local bookworm: resolved (fixed in 2.32.51.20

CVE-2018-17794 [MEDIUM] CVE-2018-17794: binutils - An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU B... An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function. Scope: local bookworm: resolved (fixed in 2.32.51.20190707-1) bullseye: resolved (fixed in 2.32.51.20190707-1) forky: resolved (fixed in 2.32.51.20190707-1) sid: re

CVE-2018-20651 [MEDIUM] CVE-2018-20651: binutils - A NULL pointer dereference was discovered in elf_link_add_object_symbols in elfl... A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld. Scope: local bookw