CVE-2019-14250: Integer Overflow
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simpleobjectelfmatch in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3Fixed in 2.46.90.20260712-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-14250.
What is the title of the vulnerability?
The title of the vulnerability is 'An issue was discovered in GNU libiberty as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.'
What is the impact of CVE-2019-14250?
The impact of CVE-2019-14250 is a heap-based buffer overflow, which can potentially be exploited by an attacker to execute arbitrary code or crash the affected system.
How can I fix CVE-2019-14250?
To fix CVE-2019-14250, you should update to GNU Binutils version 2.33 or higher.
Are there any references for CVE-2019-14250?
Yes, you can find references for CVE-2019-14250 at the following links: [Link 1](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924), [Link 2](https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html), [Link 3](http://www.securityfocus.com/bid/109354).