CVE-2018-19931: Buffer Overflow
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfdelf32swapphdrin in elfcode.h because the number of program headers is not restricted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2018-19931?
CVE-2018-19931 is a vulnerability in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils through version 2.31, which can lead to a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h.
How does CVE-2018-19931 affect my system?
CVE-2018-19931 affects systems that have the affected version of GNU Binutils installed, specifically versions up to and including 2.31.
What is the severity of CVE-2018-19931?
The severity of CVE-2018-19931 is not specified in the provided information.
How can I fix CVE-2018-19931?
To fix CVE-2018-19931, users should update their GNU Binutils to a version that is not affected. Refer to the provided references for specific version numbers and updates.
Where can I find more information about CVE-2018-19931?
You can find more information about CVE-2018-19931 in the provided references: [https://sourceware.org/bugzilla/show_bug.cgi?id=23942](https://sourceware.org/bugzilla/show_bug.cgi?id=23942), [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d181371d67534fa273dd221df20c07](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d181371d67534fa273dd221df20c07), [http://www.securityfocus.com/bid/106144](http://www.securityfocus.com/bid/106144).