PT-2019-6404 · Gnu+3 · Gnu Binutils+3

Nguyễn Đức Mạnh · Published 2019-12-27 · Updated 2024-10-21 · CVE-2020-35342

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNU Binutils versions prior to 2.34

Description The issue is related to an uninitialized-heap vulnerability in the tic4x print cond function, located in the opcodes/tic4x-dis.c component of the GNU Binutils software development tool. This vulnerability could allow a remote attacker to exploit the error and gain access to confidential data, potentially leading to an information leak.

Recommendations For GNU Binutils versions prior to 2.34, update to version 2.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the tic4x print cond function in the opcodes/tic4x-dis.c component until a patch is applied.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

BDU:2023-07819

CVE-2020-35342

USN-6381-1

Affected Products

Astra Linux

Gnu Binutils

Red Os

Ubuntu

References · 51

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=25319 · Exploit
• https://ubuntu.com/security/CVE-2020-19724 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19724 · Security Note
• https://bdu.fstec.ru/vul/2023-07814 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-35342 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45703 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35342 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07817 · Security Note
• https://bdu.fstec.ru/vul/2023-05852 · Security Note
• https://bdu.fstec.ru/vul/2023-05798 · Security Note
• https://bdu.fstec.ru/vul/2025-03966 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6381-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6381-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35342 · Vendor Advisory