CVE-2018-18605: Medium severity binutils vulnerability
A heap-based buffer over-read issue was discovered in the function secmergehashlookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because bfdaddmergesection mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-18605?
CVE-2018-18605 is a heap-based buffer over-read vulnerability in the Binary File Descriptor (BFD) library (libbfd) as distributed in GNU Binutils 2.31.
How does CVE-2018-18605 impact systems?
CVE-2018-18605 can allow an attacker to read beyond the intended boundaries of a buffer in memory, potentially leading to information disclosure or a crash.
Which software is affected by CVE-2018-18605?
The affected software includes binutils versions 2.26.1-1ubuntu1~16.04.8+, 2.30-21ubuntu1~18.04.3, and debian/binutils versions up to 2.31.1-16.
How can I fix CVE-2018-18605?
Update the affected software to version 2.26.1-1ubuntu1~16.04.8+ for Ubuntu 16.04, 2.30-21ubuntu1~18.04.3 for Ubuntu 18.04, or versions 2.35.2-2, 2.40-2, or 2.41-5 for Debian.
Where can I find more information about CVE-2018-18605?
You can find more information about CVE-2018-18605 at the following references: [1] [2] [3].