CVE-2020-35495

A heap-buffer-overflow vulnerability was found in binutils when processing a specially crafted XCOFF object file during linking. A local attacker could trick a user into processing this malicious file, leading to arbitrary code execution or denial of service.

A flaw was found in binutils, specifically within the `readelf` utility, allowing a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted ELF file. Exploitation can lead to excessive resource consumption or a program crash, making the system unresponsive.

A flaw was found in the readelf utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted ELF file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the readelf utility becoming unresponsive or crashing.

A flaw exists in bfd_pef_parse_function_stubs of bfd/pef.c in binutils versions prior to 2.34. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.

A flaw exists in bfd_pef_scan_start_address() of bfd/pef.c in binutils. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.

A flaw in binutils /opcodes/tic4x-dis.c causes the use of uninitialized memory when processing a crafted input file. The highest threat is to application availability, with a lower threat to data confidentiality. The flaw affects binutils versions prior to 2.34.

A heap buffer overflow exists in binutils in bfd/pef.c when a crafted PEF file is parsed by objdump, leading to an out-of-bounds read. The flaw affects binutils versions prior to 2.34.