CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 1CVE-2020-35494
https://notcve.org/view.php?id=CVE-2020-35494
There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34. Se presenta un fallo en el archivo /opcodes/tic4x-dis.c de binutils. • https://bugzilla.redhat.com/show_bug.cgi?id=1911439 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6 https://security.gentoo.org/glsa/202107-24 https://security.netapp.com/advisory/ntap-20210212-0007 • CWE-908: Use of Uninitialized Resource •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 1CVE-2020-35493
https://notcve.org/view.php?id=CVE-2020-35493
A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. Se presenta un fallo en el archivo bfd/pef.c de binutils. Un atacante que pueda enviar un archivo PEF diseñado para que sea analizado por objdump podría causar un desbordamiento del búfer de pila -) lectura fuera de límites que podría tener un impacto en la disponibilidad de la aplicación. • https://bugzilla.redhat.com/show_bug.cgi?id=1911437 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6 https://security.gentoo.org/glsa/202107-24 https://security.netapp.com/advisory/ntap-20210212-0007 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1010204 – binutils: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read in gold/fileread.cc and elfcpp/elfcpp_file.h leads to denial of service
https://notcve.org/view.php?id=CVE-2019-1010204
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened. GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) está afectado por: Validación incorrecta de entrada, comparación firmada / sin firmar, lectura fuera de límites. • https://security.netapp.com/advisory/ntap-20190822-0001 https://sourceware.org/bugzilla/show_bug.cgi?id=23765 https://support.f5.com/csp/article/K05032915?utm_source=f5support&%3Butm_medium=RSS https://access.redhat.com/security/cve/CVE-2019-1010204 https://bugzilla.redhat.com/show_bug.cgi?id=1735604 • CWE-125: Out-of-bounds Read CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-20712
https://notcve.org/view.php?id=CVE-2018-20712
A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt. Existe una sobrelectura de búfer basada en memoria dinámica (heap) en la función d_expression_1 en cp-demangle.c en GNU libiberty, tal y como se distribuye en GNU Binutils 2.31.1. Una entrada manipulada puede causar fallos de segmentación, conduciendo a una denegación de servicio (DoS), tal y como queda demostrado con c++filt. • http://www.securityfocus.com/bid/106563 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629 https://sourceware.org/bugzilla/show_bug.cgi?id=24043 https://support.f5.com/csp/article/K38336243 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20673 – libiberty: Integer overflow in demangle_template() function
https://notcve.org/view.php?id=CVE-2018-20673
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. La función demangle_template en cplus-dem.c en GNU libiberty, tal y como se distribuía en la versión 2.31.1 de GNU Binutils, contiene una vulnerabilidad de desbordamiento de enteros (para "Create an array for saving the template argument values") que puede provocar un desbordamiento de búfer basado en memoria dinámica (heap), tal y como queda demostrado con nm. • http://www.securityfocus.com/bid/106454 https://sourceware.org/bugzilla/show_bug.cgi?id=24039 https://access.redhat.com/security/cve/CVE-2018-20673 https://bugzilla.redhat.com/show_bug.cgi?id=1664709 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •