CVE-2018-13033: Medium severity GNU binutils vulnerability
A flaw was found in The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file. This can occur during execution of nm.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23361
Other sources
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by bfdelfparseattributes in elf-attrs.c and bfdmalloc in libbfd.c. This can occur during execution of nm.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-13033?
CVE-2018-13033 is a vulnerability in the Binary File Descriptor (BFD) library, as distributed in GNU Binutils 2.30.
How does CVE-2018-13033 impact systems?
CVE-2018-13033 allows remote attackers to cause a denial of service (excessive memory allocation and application crash) by exploiting a crafted ELF file.
What software is affected by CVE-2018-13033?
GNU Binutils versions 2.26.1-1ubuntu1~16.04.8+ to 2.41-5 are affected by CVE-2018-13033.
How can I mitigate CVE-2018-13033?
To mitigate CVE-2018-13033, update your GNU Binutils software to versions that include the fix: 2.26.1-1ubuntu1~16.04.8+, 2.30-21ubuntu1~18.04.3, 2.30.90.20180627-1, or any version after 2.41-5.
Where can I find more information about CVE-2018-13033?
You can find more information about CVE-2018-13033 at the following references: [Sourceware Bugzilla](https://sourceware.org/bugzilla/show_bug.cgi?id=23361), [SecurityFocus](http://www.securityfocus.com/bid/104584), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2018:3032).