PT-2023-5192 · Gnu+6 · Binutils+6

Published 2023-08-22 · Updated 2025-01-28 · CVE-2022-47011

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Binutils versions 2.34 through 2.38

Description An issue was discovered in the function parse stab struct fields in stabs.c, which allows attackers to cause a denial of service due to memory leaks. The vulnerability is related to a memory release error and can be exploited to cause a service disruption.

Recommendations For Binutils versions 2.34 through 2.38, consider disabling the parse stab struct fields function as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2024-9331

AZL-28048

BDU:2023-05785

CVE-2022-47011

OESA-2023-1570

ROSA-SA-2025-2645

USN-6413-1

USN-6581-1

Affected Products

Alt Linux

Astra Linux

Binutils

Debian

Linuxmint

Red Os

Ubuntu

References · 39

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=29261 · Exploit
• https://ubuntu.com/security/CVE-2022-44840 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47011 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47011 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47011 · Security Note
• https://osv.dev/vulnerability/AZL-28048 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6413-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1570 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46174 · Security Note
• https://osv.dev/vulnerability/USN-6413-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6581-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6543 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory