PT-2018-2381 · Gnu+5 · Gnu Binutils+5

Kang · Published 2018-02-17 · Updated 2024-06-15 · CVE-2018-7208

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.30

Description The issue is related to the coff pointerize aux function in the Binary File Descriptor (BFD) library, where an index is not validated. This allows remote attackers to cause a denial of service, potentially leading to a segmentation fault, or possibly have other unspecified impacts via a crafted file. For example, this can be demonstrated by objcopy of a COFF object.

Recommendations For GNU Binutils version 2.30, consider updating to a newer version that addresses this issue, as the current version allows for potential denial of service or other impacts due to the lack of index validation in the coff pointerize aux function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1204

ALT-PU-2019-1367

BDU:2019-00569

CESA-2018_3032

CVE-2018-7208

MGASA-2019-0169

OPENSUSE-SU-2018_3223-1

OPENSUSE-SU-2018_3323-1

OPENSUSE-SU-2019:2415-1

OPENSUSE-SU-2019:2432-1

OPENSUSE-SU-2019_2415-1

OPENSUSE-SU-2019_2432-1

OPENSUSE-SU-2024:10651-1

OPENSUSE-SU-2024:12745-1

RHSA-2018:3032

RHSA-2018_3032

SUSE-SU-2018:3170-1

SUSE-SU-2018:3207-1

SUSE-SU-2018:3207-2

SUSE-SU-2019:2779-1

SUSE-SU-2019:2780-1

SUSE-SU-2023:2485-1

SUSE-SU-2024:0319-1

SUSE-SU-2024:0898-1

SUSE-SU-2024:0899-1

USN-4336-2

Affected Products

Alt Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

References · 822

• https://osv.dev/vulnerability/openSUSE-SU-2024:10651-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07788 · Security Note
• https://bdu.fstec.ru/vul/2023-07735 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9077 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12452 · Security Note
• https://ubuntu.com/security/CVE-2018-18700 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2432-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01241 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18483 · Security Note
• https://ubuntu.com/security/CVE-2016-4490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18701 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9754 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2415-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9742 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15022 · Security Note