GNU Binutils 2.28 vulnerabilities

The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.

GNU Binutils 2.29.1 has a mishandling issue with certain global symbols in nm.c and objdump.c, which can lead to application crashes or denial of service.

The _bfd_coff_read_string_table function in the BFD library (libbfd) in GNU Binutils 2.29.1 does not properly validate the size of the external string table, which can lead to denial of service or buffer overflow.

The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which can lead to denial of service or heap-based buffer overflow.

The Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.

The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.

The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 lacks integer-overflow protection on 32-bit platforms, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.

The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not prevent negative pointers, which may lead to application crashes or other unspecified impacts via a crafted ELF file.

The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.

The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.

In elfcomm.c in readelf in GNU Binutils 2.29, a vulnerability allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file. The issue is related to a buffer overflow on a fuzzed archive header, concerning an uninitialized variable and an improper conditional jump.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 interpret a -1 value as a sorting count instead of an error flag. This can lead to denial of service (integer overflow and application crash) when processing a crafted ELF file.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 do not ensure a unique PLT entry for a symbol. This allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file.

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next during 'readelf -a' execution.

The setup_group function in elf.c in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

The elf_read_notes function in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The bfd_mach_o_read_symtab_strtab function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap write, potentially leading to code execution via a crafted mach-o file.

The bfd_make_section_with_flags function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause a NULL dereference via a crafted file.

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils version 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

The _bfd_vms_slurp_egsd function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

The _bfd_vms_slurp_eeom function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

The bfd_mach_o_i386_canonicalize_one_reloc function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

The _bfd_xcoff_read_ar_hdr function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

The _bfd_vms_save_sized_string function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms file.

The bfd_cache_close function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause a heap use after free, potentially leading to code execution via a crafted nested archive file. This issue arises from incorrect function calls during an attempt to release memory.

The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The process_otr function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 does not validate a certain offset, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The versados_mkobject function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 does not initialize a certain data structure, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or potentially other unspecified impacts via a crafted binary file.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 contains a vulnerability that allows remote attackers to cause application crashes via buffer overflow when processing a specially crafted binary file.

In GNU Binutils 2.28, the unbounded GETBYTE macro in opcodes/rl78-decode.opc allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

In GNU Binutils 2.28, the opcodes/rx-decode.opc file lacks bounds checks for certain scale arrays, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or potentially unspecified other impact via a crafted binary file.

The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The ieee_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils version 2.28 may allow remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file, as demonstrated during 'objdump -D' execution.

The ieee_archive_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 may allow remote attackers to cause application crashes via buffer overflow, leading to denial of service. This issue may be related to a compiler bug.

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The _bfd_vms_slurp_etir function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 allows remote attackers to cause a denial of service via a buffer overflow, leading to application crash. This issue occurs when handling a crafted binary file during 'objdump -D' execution.

The sh_elf_set_mach_from_flags function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 allows remote attackers to cause a denial of service via a buffer overflow, leading to application crash. This issue occurs when handling a crafted binary file during 'objdump -D' execution.

The print_insn_score32 function in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file, as demonstrated by mishandling of this file during 'objdump -D' execution.

The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The readelf.c in GNU Binutils as of 2017-04-12 has a 'shift exponent too large for type unsigned long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

The readelf.c in GNU Binutils as of 2017-04-12 has a 'cannot be represented in type long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

The dwarf.c file in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that analyze binary files, such as objdump and readelf, to crash.

The Binary File Descriptor (BFD) library, known as libbfd, in GNU Binutils version 2.28 is vulnerable to an invalid read of size 1. Existing reloc offset range tests did not catch small negative offsets, leading to crashes of programs analyzing binary files, such as objdump.

The Binary File Descriptor (BFD) library, known as libbfd, in GNU Binutils version 2.28 is vulnerable to an invalid write of size 8 due to missing a malloc() return-value check in the _bfd_generic_get_section_contents function. This vulnerability causes programs analyzing binary files using the libbfd library, such as objcopy, to crash.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to a global buffer over-read error. The issue arises from the assumption that SHT_REL/SHR_RELA sections always start with a .rel/.rela prefix, leading to crashes in programs analyzing binary files.

The Binary File Descriptor (BFD) library, known as libbfd, in GNU Binutils version 2.28 is vulnerable to an invalid read of size 8 due to missing a check for NULL symbols in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes crashes in programs analyzing binary files using the libbfd library, such as objdump.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to an invalid read due to a missing check on the sh_link field in the copy_special_section_fields function. This can cause Binutils utilities like strip to crash.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to an invalid read due to missing a check for null headers in the find_link function. This can cause Binutils utilities like strip to crash.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has a swap_std_reloc_out function that is vulnerable to an invalid read due to missing checks for unrecognized relocs. This vulnerability causes Binutils utilities like strip to crash.