CVE-2018-17985: Medium severity GNU binutils vulnerability
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplusdemangletype function making recursive calls to itself in certain scenarios involving many 'P' characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3Fixed in 2.46.90.20260712-1 - Upgrade
Upgrade
GNU Binutils (GNU libiberty cp-demangle.c, cplus_demangle_type)to a version that resolves this vulnerability.Fixed in 2.31
Event History
Frequently Asked Questions
What is CVE-2018-17985?
CVE-2018-17985 is a vulnerability in GNU libiberty, as distributed in GNU Binutils 2.31, that causes a stack consumption problem in certain scenarios involving many 'P' characters.
Who is affected by CVE-2018-17985?
Users of GNU Binutils 2.31 are affected by CVE-2018-17985.
How can I fix CVE-2018-17985?
To fix CVE-2018-17985, upgrade to binutils version 2.35.2-2, 2.40-2, or 2.41-5.
Are there any references available for CVE-2018-17985?
Yes, you can find references for CVE-2018-17985 at the following links: [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87335](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87335), [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html), [http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html)