PT-2019-19350 · Gnu+1 · Gnu Binutils+1

Spinpx · Published 2019-02-24 · Updated 2021-12-10 · CVE-2019-9072

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.32

Description A problem has been discovered in the Binary File Descriptor (BFD) library, also known as libbfd, as distributed in GNU Binutils. The issue is an attempted excessive memory allocation in the setup group function in elf.c.

Recommendations For GNU Binutils version 2.32, consider updating to a newer version to mitigate the risk, as the issue is related to an attempted excessive memory allocation in the setup group function. As a temporary workaround, consider restricting access to the elf.c file or the setup group function until a patch is available.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2020-3352

ALT-PU-2020-3433

ALT-PU-2021-1230

CVE-2019-9072

Affected Products

Alt Linux

Gnu Binutils

References · 73

• 🔥 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89396 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=24237 · Exploit
• https://bdu.fstec.ru/vul/2023-07807 · Security Note
• https://bdu.fstec.ru/vul/2023-05795 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35494 · Security Note
• https://bdu.fstec.ru/vul/2023-07804 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35493 · Security Note
• https://ubuntu.com/security/CVE-2019-9072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07808 · Security Note
• https://bdu.fstec.ru/vul/2023-07812 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17450 · Security Note
• https://bdu.fstec.ru/vul/2023-07809 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9072 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9077 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35495 · Security Note