PT-2006-3326 · Gnu · Gnu Binutils+1

Jesus Olmos Gonzalez · CVE-2006-2362 · Published 2006-05-15 · Updated 2025-01-16

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNU Binutils versions prior to 20060423

Description The issue allows context-dependent attackers to cause a denial of service, potentially leading to application crashes, and possibly execute arbitrary code. This can be achieved via a file with a crafted Tektronix Hex Format (TekHex) record where the length character is not a valid hexadecimal character.

Recommendations For GNU Binutils versions prior to 20060423, update to a version released after 20060423 to resolve the issue. As a temporary workaround, consider restricting the use of the getsym function in tekhex.c until a patch is available. Avoid using the vulnerable libbfd component with untrusted input files to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2006-2362

Affected Products

Gnu Binutils

Libbfd

References · 23

• 🔥 http://securityfocus.com/bid/17950 · Exploit
• 🔥 http://sourceware.org/bugzilla/show_bug.cgi?id=2584 · Exploit
• 🔥 https://exploit-db.com/exploits/27856 · Exploit
• 🔥 http://mail-archive.com/[e-mail]/msg01516.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2006-2362 · Vendor Advisory
• http://ubuntu.com/usn/usn-292-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2362 · Security Note
• http://novell.com/linux/security/advisories/2006_26_sr.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-2362 · Vendor Advisory
• http://trustix.org/errata/2006/0034 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2362 · Vendor Advisory
• http://secunia.com/advisories/20531 · Note
• http://vupen.com/english/advisories/2007/3665 · Note
• http://mail-archive.com/bug-binutils%40gnu.org/msg01516.html · Note