U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/a:gnu:binutils:2.11.2
There are 50 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2023-25584

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

Published: September 14, 2023; 5:15:10 PM -0400
V3.1: 7.1 HIGH
V2.0:(not available)
CVE-2022-48065

GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

Published: August 22, 2023; 3:16:31 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2022-48064

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2022-48063

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2022-47696

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-47695

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-47673

An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-45703

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-44840

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

Published: August 22, 2023; 3:16:30 PM -0400
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2021-46174

Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.

Published: August 22, 2023; 3:16:21 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2020-35342

GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.

Published: August 22, 2023; 3:16:20 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2020-21490

An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.

Published: August 22, 2023; 3:16:13 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2020-19724

A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

Published: August 22, 2023; 3:16:03 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2022-38533

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

Published: August 25, 2022; 8:15:09 PM -0400
V3.1: 5.5 MEDIUM
V2.0:(not available)
CVE-2021-45078

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

Published: December 15, 2021; 3:15:08 PM -0500
V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM
CVE-2021-37322

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Published: November 18, 2021; 5:15:07 PM -0500
V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM
CVE-2021-20197

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Published: March 26, 2021; 1:15:12 PM -0400
V3.1: 6.3 MEDIUM
V2.0: 3.3 LOW
CVE-2020-35507

There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.

Published: January 04, 2021; 10:15:15 AM -0500
V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-35496

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Published: January 04, 2021; 10:15:14 AM -0500
V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-35495

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Published: January 04, 2021; 10:15:13 AM -0500
V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM