PT-2018-2385 · Gnu+3 · Gnu Binutils+3

Publicado

2018-02-06

·

Atualizado

2024-06-15

·

CVE-2018-6759

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.30
Description The issue is related to the bfd get debug link info 1 function in opncls.c, which lacks a check on the result of the strnlen function. This can be exploited by a remote attacker to cause a denial of service, potentially leading to a segmentation fault, by providing a crafted ELF file.
Recommendations For GNU Binutils version 2.30, consider disabling the bfd get debug link info 1 function as a temporary workaround until a patch is available. Restrict access to the opncls.c library to minimize the risk of exploitation. Avoid using the strnlen function in the affected bfd get debug link info 1 function until the issue is resolved.

Correção

DoS

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2019-1204
ALT-PU-2019-1367
BDU:2019-00574
CVE-2018-6759
MGASA-2019-0169
OPENSUSE-SU-2018_3223-1
OPENSUSE-SU-2018_3323-1
OPENSUSE-SU-2019:2415-1
OPENSUSE-SU-2019:2432-1
OPENSUSE-SU-2019_2415-1
OPENSUSE-SU-2019_2432-1
OPENSUSE-SU-2024:10651-1
SUSE-SU-2018:3170-1
SUSE-SU-2018:3207-1
SUSE-SU-2018:3207-2
SUSE-SU-2019:2779-1
SUSE-SU-2019:2780-1
USN-4336-2

Produtos afetados

Alt Linux
Gnu Binutils
Suse
Ubuntu