CVE-2021-3826: Buffer Overflow
A vulnerability was found in Libiberty. A heap and stack buffer overflow found in the dlanglname function in d-demangle.c leads to a denial of service.
Other sources
Heap/stack buffer overflow in the dlanglname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/devtoolsetto a version that resolves this vulnerability.Fixed in 12-binutils-0:2.36.1-6.el7 - Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.37.50.20220121-1 - Upgrade
Upgrade
debian/libibertyto a version that resolves this vulnerability.Fixed in 20220713-1 - Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.40-2Fixed in 2.44-3Fixed in 2.47.50.20261021-1 - Upgrade
Upgrade
debian/libibertyto a version that resolves this vulnerability.Fixed in 20230104-1Fixed in 20250315-1Fixed in 20260327-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-3826.
What is the severity of CVE-2021-3826?
The severity of CVE-2021-3826 is high with a CVSS score of 7.5.
What is the description of CVE-2021-3826?
CVE-2021-3826 is a heap/stack buffer overflow in the dlang_lname function in libiberty, allowing attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.
Which software packages are affected by CVE-2021-3826?
The affected software packages include devtoolset 12-binutils-0:2.36.1-6.el7, GNU GCC 11.2, and Fedora versions 35, 36, and 37.
How can I fix CVE-2021-3826?
To fix CVE-2021-3826, it is recommended to update to the latest version of the affected software packages provided by the respective vendors.