PT-2025-6161 · Gnu+5 · Gnu Binutils+5

Wenjusun · Published 2025-02-05 · Updated 2026-04-20 · CVE-2025-1176

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43

Description A critical issue affects the function bfd elf gc mark rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.

Recommendations Apply a patch to fix this issue, specifically the patch named f9978defb6fab0bd8583942d97c112b0932ac814. As a temporary workaround, consider restricting access to the vulnerable function bfd elf gc mark rsec until a patch is applied.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

AZL-56579

AZL-56652

AZL-56655

BDU:2025-11823

CVE-2025-1176

ECHO-ADCD-7287-F168

MGASA-2025-0262

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

USN-7423-1

USN-7423-2

Affected Products

Astra Linux

Debian

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 108

• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=15913 · Exploit
• 🔥 https://vuldb.com/?submit.495329 · Exploit
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814 · Patch
• https://sourceware.org/bugzilla/show_bug.cgi?id=32636 · Patch
• https://osv.dev/vulnerability/USN-7423-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0262 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1176 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0840 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1176 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7423-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-56652 · Vendor Advisory