PT-2018-3965 · Gnu+4 · Gnu Binutils+4

Dongdong She · Published 2018-11-20 · Updated 2026-01-30 · CVE-2018-19932

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Binutils versions through 2.31

Description An issue in the Binary File Descriptor (BFD) library, specifically in the elf.c component, is related to the IS CONTAINED BY LMA macro. This issue causes an integer overflow and an infinite loop. The exploitation of this issue can lead to a denial of service by a remote attacker.

Recommendations For GNU Binutils versions through 2.31, consider updating to a version that addresses the integer overflow and infinite loop issue caused by the IS CONTAINED BY LMA macro in elf.c. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2018-2665

ALT-PU-2019-1204

ALT-PU-2019-1367

BDU:2023-07794

CLEANSTART-2026-HF39630

CVE-2018-19932

OPENSUSE-SU-2019:2415-1

OPENSUSE-SU-2019:2432-1

OPENSUSE-SU-2019_2415-1

OPENSUSE-SU-2019_2432-1

OPENSUSE-SU-2024:10651-1

SUSE-SU-2019:2650-1

SUSE-SU-2019:2779-1

SUSE-SU-2019:2780-1

USN-4336-1

USN-4336-2

Affected Products

Alt Linux

Astra Linux

Gnu Binutils

Suse

Ubuntu

References · 337

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=23932 · Exploit
• https://ubuntu.com/security/CVE-2018-20671 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17794 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2650-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15939 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20002 · Security Note
• https://ubuntu.com/security/CVE-2016-4490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7300 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16827 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9038 · Vendor Advisory
• https://security.gentoo.org/glsa/201908-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12456 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19932 · Vendor Advisory