GNU Binutils 2.28 vulnerabilities

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an off-by-one vulnerability in the aout_link_add_symbols function due to improper string offset checking. This could lead to a crash of the GNU linker (ld) program.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an aout_link_add_symbols function that is vulnerable to a heap-based buffer over-read (off-by-one) due to an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.

The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where both the main file name and the directory name are empty, leading to a NULL pointer dereference and an invalid write, resulting in a program crash.

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.

A stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

A stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

A heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

The setup_group function in bfd/elf.c in libbfd in GNU binutils version 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen. This can lead to crashes in programs such as addr2line, size, and strings, as well as information disclosure.

ihex.c in GNU Binutils before version 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.

readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.

In the BFD library of GNU binutils, the DLX ELF backend's dlx_rtype_to_howto() function lacks bounds checking, allowing out-of-bounds write. A crafted ELF/DLX file can lead to arbitrary code execution.

A vulnerability in the GNU Binutils linker causes a heap-buffer-overflow read when processing a specially crafted 32-bit XCOFF object file. An attacker can provide a malicious file, leading to heap data disclosure and linker crash (DoS).

A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.

A heap-based buffer overflow (out-of-bounds read) vulnerability was found in the bfd linker component of GNU Binutils. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file.

A heap-based buffer overflow vulnerability (out-of-bounds read) was found in the bfd linker of GNU Binutils. An attacker can exploit a specially crafted XCOFF object file to access sensitive information or cause an application-level denial of service.