孙文举

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.43 **Description** A memory leak vulnerability has been found in the ld component of GNU Binutils, specifically affecting the `xstrdup` function in the `libiberty/xmalloc.c` file. This issue can be exploited remotely, with a relatively high complexity of attack. The exploitability is considered difficult. The vulnerability allows for a memory leak, which can be initiated remotely. **Recommendations** To fix this issue, it is recommended to apply a patch. The code maintainer has fixed all reported leaks in the binutils master branch, but has not committed these fixes to the 2.44 branch due to concerns about destabilizing ld. As a temporary workaround, consider restricting the use of the `xstrdup` function in the affected ld component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.43 **Description** A memory leak vulnerability has been found in GNU Binutils, affecting the `bfd malloc` function of the `libbfd.c` file in the `ld` component. The manipulation of this vulnerability can lead to a memory leak. The attack can be initiated remotely, and the complexity of the attack is rather high. The exploitation appears to be difficult. The code maintainer has stated that the reported leaks have been fixed in the `binutils master` branch. **Recommendations** For GNU Binutils version 2.43, apply a patch to fix this issue. As a temporary workaround, consider restricting the use of the `bfd malloc` function in the `libbfd.c` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.43 **Description** A memory leak issue affects the `xmemdup` function of the `ld` component in the `xmemdup.c` file. This issue can be exploited remotely, but the complexity of an attack is rather high, and the exploitation is known to be difficult. The code maintainer has fixed all reported leaks in the `binutils` master branch. **Recommendations** For GNU Binutils version 2.43, it is recommended to apply a patch to fix this issue. As a temporary workaround, consider restricting the use of the `xmemdup` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.43 **Description** A memory leak issue has been found in the `xstrdup` function of the `ld` component. This issue can be exploited remotely, but the complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public. The code maintainer has fixed all reported leaks in the `binutils` master branch. **Recommendations** For GNU Binutils version 2.43, it is recommended to apply a patch to fix this issue. As a temporary workaround, consider restricting the use of the `xstrdup` function in the `ld` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.43 **Description** A vulnerability was found in GNU Binutils, affecting the function `bfd putl64` of the file `libbfd.c` of the component `ld`. The manipulation leads to memory corruption. The attack can be launched remotely, but the complexity of an attack is rather high and the exploitation appears to be difficult. **Recommendations** To fix this issue, it is recommended to apply a patch, specifically the one with the identifier `75086e9de1707281172cc77f178e7949a4414ed0`. As a temporary workaround, consider disabling the `bfd putl64` function until a patch is available. Restrict access to the `libbfd.c` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** binutils nm versions 2.43 and later **Description** The issue is related to incorrect access control, which can be exploited locally. The component affected is the `nm --without-symbol-version` function. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For binutils nm versions 2.43 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.