PT-2019-10156 · Gnu+6 · Gnu Binutils+6

Tfx · Published 2018-12-27 · Updated 2026-04-20 · CVE-2018-20673

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.31.1

Description: The demangle template function in cplus-dem.c contains an integer overflow vulnerability that can trigger a heap-based buffer overflow. This issue is demonstrated by the nm tool.

Recommendations: For GNU Binutils version 2.31.1, consider updating to a newer version that contains a fix for this issue, as using the demangle template function can lead to a heap-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALSA-2021:4386

ALT-PU-2019-3046

AZL-41601

CESA-2021_4386

CVE-2018-20673

ECHO-4D86-022A-58EE

RHSA-2021:4386

RHSA-2021_4386

RLSA-2021:4386

Affected Products

Alt Linux

Almalinux

Centos

Debian

Gnu Binutils

Red Hat

Rocky Linux

References · 22

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=24039 · Exploit
• https://osv.dev/vulnerability/AZL-41601 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2018-20673 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4386 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4386 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20673 · Security Note
• https://ubuntu.com/security/CVE-2018-20673 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20673 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20673 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20673 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20673 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4386 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-4386.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1965951 · Note