GNU Binutils vulnerabilities

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an off-by-one vulnerability in the aout_link_add_symbols function due to improper string offset checking. This could lead to a crash of the GNU linker (ld) program.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an aout_link_add_symbols function that is vulnerable to a heap-based buffer over-read (off-by-one) due to an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.

The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where both the main file name and the directory name are empty, leading to a NULL pointer dereference and an invalid write, resulting in a program crash.

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.

A stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

A stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

A heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

The setup_group function in bfd/elf.c in libbfd in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen. This can lead to crashes in programs such as addr2line, size, and strings, as well as information disclosure.

ihex.c in GNU Binutils before version 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.

readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_64_common_section_index in bfd/elf64-x86-64.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_link_add_object_symbols in bfd/elflink.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_strtab_delref of file bfd/elf-strtab.c, related to the ELF String Table. The manipulation results in memory corruption. The attack requires local access and the exploit is publicly available.

A security vulnerability has been detected in GNU Binutils 2.47 in the function _bfd_write_merged_section of file bfd/merge.c, related to Section Merge. The manipulation leads to a null pointer dereference. The attack requires local access and the exploit has been publicly disclosed.

A weakness has been identified in GNU Binutils 2.47 in the function bfd_elf_set_group_contents of file bfd/elf.c, related to the SHT_GROUP Section Handler. The manipulation can lead to a null pointer dereference. The attack requires local access and the exploit is publicly available.

A security flaw has been discovered in GNU Binutils 2.47 in the function elf_orphan_compatible of file ld/ldelf.c, related to the ELF Orphan Section Handler. The manipulation results in a null pointer dereference. The attack requires local access and the exploit has been publicly released.

In GNU Binutils 2.47, a vulnerability was detected in the function _bfd_elf_write_section_eh_frame in the file bfd/elf-eh-frame.c, in the Eh Frame Section Handler component. Manipulation of the arguments cie_length/fde_length/augmentation_data_size/write_offset leads to a buffer overflow. The attack requires local access.

In GNU Binutils 2.47, a vulnerability was detected in the function elf_x86_64_relocate_section in the file bfd/elf64-x86-64.c, in the ld component. Manipulation of the argument roff leads to a buffer overflow. The attack requires local access. A fix is available in version 2.48.

In GNU Binutils 2.47, a weakness was identified in the function bfd_putl64 in the file bfd/libbfd.c, in the ld component. This manipulation causes a null pointer dereference. The attack requires local access.

In GNU Binutils 2.47, a security flaw was discovered in the function cache_bwrite in the file bfd/cache.c, in the ld component. Manipulation of the argument nbytes results in a buffer overflow. The attack requires local access.

In the BFD library of GNU binutils, the DLX ELF backend's dlx_rtype_to_howto() function lacks bounds checking, allowing out-of-bounds write. A crafted ELF/DLX file can lead to arbitrary code execution.

A vulnerability in the GNU Binutils linker causes a heap-buffer-overflow read when processing a specially crafted 32-bit XCOFF object file. An attacker can provide a malicious file, leading to heap data disclosure and linker crash (DoS).

A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.

A heap-based buffer overflow (out-of-bounds read) vulnerability was found in the bfd linker component of GNU Binutils. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file.

A heap-based buffer overflow vulnerability (out-of-bounds read) was found in the bfd linker of GNU Binutils. An attacker can exploit a specially crafted XCOFF object file to access sensitive information or cause an application-level denial of service.

A vulnerability in GNU Binutils 2.45 affects the vfinfo function in the ldmisc.c file. Manipulation leads to an out-of-bounds read. The attack can only be executed locally. The exploit is publicly available. The patch is called 16357.

In GNU Binutils 2.45, the elf_x86_64_relocate_section function in elf64-x86-64.c of the Linker component has a heap-based buffer overflow. The attack can only be executed locally, and the exploit has been publicly disclosed. It is recommended to deploy the patch named 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0.

In GNU Binutils 2.45, the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c of the Linker component has an out-of-bounds read. The attack needs to be approached locally, and the exploit has been made public. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a.

A vulnerability was determined in GNU Binutils 2.45 in the function get_link_hash_entry of the file bfd/elflink.c of the Linker component. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed. Upgrading to version 2.46 addresses this issue.

A vulnerability was found in GNU Binutils 2.45 in the function elf_link_add_object_symbols in bfd/elflink.c of the Linker component. The manipulation results in an out-of-bounds read. The attack requires local access. The exploit has been made public and could be used. Upgrading to version 2.46 addresses the issue.

A vulnerability has been found in GNU Binutils 2.45 in the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the Linker component. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc.

A vulnerability was found in GNU Binutils 2.45 in the elf_swap_shdr function in the bfd/elfcode.h library of the Linker component. Manipulation leads to a heap-based buffer overflow. The attack must be performed locally, and the exploit has been publicly disclosed.

A flaw was found in GNU Binutils 2.45 in the _bfd_elf_parse_eh_frame function in bfd/elf-eh-frame.c of the Linker component. Executing manipulation leads to a heap-based buffer overflow. The attack is restricted to local execution, and the exploit has been published.

A vulnerability was detected in GNU Binutils 2.45 affecting the dump_dwarf_section function in binutils/objdump.c. Manipulation results in an out-of-bounds read. The attack requires local access and the exploit is now public.

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.