CVE-2018-18701: Medium severity GNU binutils vulnerability
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions nextistypequal() and cplusdemangletype() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3Fixed in 2.46.90.20260712-1 - Upgrade
Upgrade
GNU Binutils (libiberty cp-demangle.c)to a version that resolves this vulnerability.Fixed in 2.31
Event History
Frequently Asked Questions
What is CVE-2018-18701?
CVE-2018-18701 is a stack consumption vulnerability in GNU libiberty, as distributed in GNU Binutils 2.31.
How does CVE-2018-18701 affect me?
CVE-2018-18701 allows remote attackers to cause a denial of service (DoS) by leveraging the vulnerability.
Which software versions are affected by CVE-2018-18701?
Versions 2.26.1-1ubuntu1~16.04.8+ and 2.30-21ubuntu1~18.04.3 of binutils, and versions 20170913-1ubuntu0.1, 20190122-1, and 20160215-1ubuntu0.3 of libiberty are affected by CVE-2018-18701.
How can I fix CVE-2018-18701?
To fix CVE-2018-18701, update to the patched versions of binutils and libiberty.
Where can I find more information about CVE-2018-18701?
You can find more information about CVE-2018-18701 at the following references: [link1], [link2], [link3].