CVE-2023-25588: Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`
First published: Mon Feb 06 2023(Updated: )
A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU Binutils | =2.40 |
Remedy
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2023-25588
- https://bugzilla.redhat.com/show_bug.cgi?id=2167505
- https://sourceware.org/bugzilla/show_bug.cgi?id=29677
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167467
- https://security.netapp.com/advisory/ntap-20231103-0003/
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2023-25588.
What is the severity rating for CVE-2023-25588?
The severity rating for CVE-2023-25588 is medium with a value of 5.5.
How does this vulnerability impact the affected software?
This vulnerability may lead to an application crash and local denial of service in the affected software.
What is the affected version of GNU Binutils?
The affected version of GNU Binutils is 2.40.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [Red Hat Security Advisory](https://access.redhat.com/security/cve/CVE-2023-25588), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2167505), [Sourceware Bugzilla](https://sourceware.org/bugzilla/show_bug.cgi?id=29677).
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/type
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/title
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-25588
- vendor/gnu
- canonical/gnu binutils
- version/gnu binutils/2.40