PT-2018-2388 · Gnu+5 · Gnu Binutils+5

Skysider · Published 2018-02-28 · Updated 2024-06-15 · CVE-2018-7569

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.30

Description The issue is related to the parse die function in the dwarf2.c file of the Binary File Descriptor (BFD) library, also known as libbfd, which is part of GNU Binutils. It allows remote attackers to cause a denial of service, resulting in an integer underflow or overflow and an application crash, by using an ELF file with a corrupt DWARF FORM block.

Recommendations For GNU Binutils version 2.30, consider updating to a newer version that contains a fix for this issue, as the current version is affected by the integer underflow or overflow vulnerability in the dwarf2.c file. As a temporary workaround, consider restricting the use of the parse die function in the dwarf2.c file until a patch is available.

Exploit

Fix

DoS

Integer Underflow

Integer Overflow

Weakness Enumeration

CWE-191

CWE-190

Related Identifiers

ALT-PU-2019-1204

ALT-PU-2019-1367

BDU:2019-00577

CESA-2018_3032

CVE-2018-7569

MGASA-2019-0169

OPENSUSE-SU-2018_3223-1

OPENSUSE-SU-2018_3323-1

OPENSUSE-SU-2019:2415-1

OPENSUSE-SU-2019:2432-1

OPENSUSE-SU-2019_2415-1

OPENSUSE-SU-2019_2432-1

OPENSUSE-SU-2024:10651-1

RHSA-2018:3032

RHSA-2018_3032

SUSE-SU-2018:3170-1

SUSE-SU-2018:3207-1

SUSE-SU-2018:3207-2

SUSE-SU-2019:2779-1

SUSE-SU-2019:2780-1

USN-4336-2

Affected Products

Alt Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

References · 805

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=22895 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10651-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07788 · Security Note
• https://bdu.fstec.ru/vul/2023-07735 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9077 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12452 · Security Note
• https://ubuntu.com/security/CVE-2018-18700 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2432-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01241 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18483 · Security Note
• https://ubuntu.com/security/CVE-2016-4490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18701 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9754 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2415-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9742 · Vendor Advisory