CVE-2018-18606: Null Pointer Dereference
Published Oct 23, 2018
·Updated
An issue was discovered in the mergestrings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
Affected Software
6 affected componentsFixes available
debian/binutils
2.35.2-22.40-22.44-3
GNU binutils=2.31
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
NetApp Data ONTAP
Remediation
Event History
Oct 23, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:57 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:00 AM
RemedyDescriptionSeverityAffected Software
Jan 30, 2025
Data Sourced
via Debian·02:46 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-18606.
2
What is the affected software?
The affected software is Binutils.
3
How does the vulnerability occur?
The vulnerability occurs in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.
4
What is the severity of CVE-2018-18606?
The severity of CVE-2018-18606 is not specified.
5
Is there a fix for CVE-2018-18606?
Yes, there are fixes available for different versions of Binutils.