CVE-2018-6323: Integer Overflow
Last updated 24 July 2024
Other sources
The elfobjectp function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfdsizetype multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3 - Upgrade
Upgrade
GNU Binutils (libbfd / BFD library) elfcode.h elf_object_pto a version that resolves this vulnerability.Fixed in 2.29.1
Event History
Frequently Asked Questions
What is CVE-2018-6323?
CVE-2018-6323 is a vulnerability in the Binary File Descriptor (BFD) library, as distributed in GNU Binutils 2.29.1, that allows remote attackers to cause a denial of service.
How does CVE-2018-6323 affect the affected software?
CVE-2018-6323 affects versions of the Binutils package on Ubuntu Xenial, Trusty, and Debian systems.
What is the severity of CVE-2018-6323?
CVE-2018-6323 has a severity rating of high.
Is there a fix available for CVE-2018-6323?
Yes, there are fixed versions of the affected software available: Ubuntu Xenial - 2.26.1-1ubuntu1~16.04.8+, Ubuntu Trusty - 2.24-5ubuntu14.2+, and Debian Binutils - 2.31.1-16, 2.35.2-2, 2.40-2, 2.41-5.
Where can I find more information about CVE-2018-6323?
You can find more information about CVE-2018-6323 at the following references: [Sourceware](https://sourceware.org/bugzilla/show_bug.cgi?id=22746), [SecurityFocus](http://www.securityfocus.com/bid/102821), [Exploit-DB](https://www.exploit-db.com/exploits/44035/).