CVE-2018-6543: Integer Overflow
In GNU Binutils 2.30, there's an integer overflow in the function loadspecificdebugsection() in objdump.c, which results in malloc() with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2018-6543?
CVE-2018-6543 is a vulnerability found in GNU Binutils 2.30 that allows for an integer overflow in the function load_specific_debug_section() in objdump.c, leading to a denial of service or other unspecified impact.
How does CVE-2018-6543 impact the system?
CVE-2018-6543 can cause a denial of service (application crash) or possibly have other unspecified impacts on the affected system.
Which software versions are affected by CVE-2018-6543?
GNU Binutils 2.30 is affected by CVE-2018-6543.
Is there a fix available for CVE-2018-6543?
Yes, there are fixes available for CVE-2018-6543. For Ubuntu, version 2.30-3 or later is recommended, while for Debian, versions 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5 are recommended.
Where can I find more information about CVE-2018-6543?
More information about CVE-2018-6543 can be found at the following references: [1] https://sourceware.org/bugzilla/show_bug.cgi?id=22769 [2] http://www.securityfocus.com/bid/102985 [3] https://security.gentoo.org/glsa/201811-17