There's a flaw in binutils 2.46.1 in rsrcprintname() and rsrcparseentries() functions by which an attacker with local access or whom does not have local access but social engineers a victim to run binutils on a crafted PE file, can execute malicious code.
USN-7423-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2025-0840) It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash, expose sensitive information or execute arbitrary code. (CVE-2025-1153) It was discovered that ld in GNU binutils incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-1176)
A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfdputl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer explains, that "[t]his bug has been fixed at some point between the 2.43 and 2.44 releases".
A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfdsetformat of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.
GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4xprintcond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.
An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.
A memory consumption issue in getdata function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.
In Binutils, at function bfdinitsectiondecompressstatus, a local variable is supposed to be initialized by function bfdcheckcompressionheader. However, since this function call is inside an else if branch, if the previous if branch is taken, the chtype can be uninitialized and thus directly used to assign sec->compressstatus. Therefore, when the compressstatus field is used in a branch condition, the memory sanitizer aborts.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=29855
Upstream fix:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502
Last updated 24 July 2024
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.34, in bfdelfgetsymbolversionstring, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
External References:
https://sourceware.org/bugzilla/showbug.cgi?id=25842 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d55d10ac0d112c586eaceb92e75bd9b80aadcc4
A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scanunitforsymbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file.
A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfdhashlookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in processsymboltable, as demonstrated in readeif.
A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the processsymboltable, as demonstrated in readelf, via a crafted file.
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcppfile.h:644. The attack vector is: An ELF file with an invalid eshoff header field must be opened.
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in setupgroup in elf.c.
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in elfreadnotes in elf.c.
An integer overflow was found in objdump, bfdgetdynamicrelocupperbound and bfdcanonicalizedynamicreloc functions of binutils. A local attacker could use this to crash the application or potentially achieve code execution.
Upstream issue:
https://sourceware.org/bugzilla/showbug.cgi?id=23994
Upstream patch:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3a551c7a1b80fca579461774860574eabfd7f18f
A flaw was found in finishstab in stabs.c in GNU Binutils 2.30 which allows attackers to cause a denial of service (heap-based buffer overflow) as demonstrated by an out-of-bounds write of 8 bytes.
References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102 https://gcc.gnu.org/bugzilla/showbug.cgi?id=85454 https://sourceware.org/bugzilla/showbug.cgi?id=23057
A flaw was found in in GNU libiberty, as distributed in GNU Binutils 2.30. A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in workstuffcopytofrom in cplus-dem.c.
References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102 https://gcc.gnu.org/bugzilla/showbug.cgi?id=85454 https://sourceware.org/bugzilla/showbug.cgi?id=23057
An issue was discovered in armpt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demanglearmhptemplate, demangleclassname, demanglefundtype, dotype, doarg, demangleargs, and demanglenestedargs. This can occur during execution of nm-new.
References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763099 https://gcc.gnu.org/bugzilla/showbug.cgi?id=85452 https://sourceware.org/bugzilla/showbug.cgi?id=23058
The getsyntheticsymtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.
The getsyntheticsymtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.
The getsyntheticsymtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elfi386getsyntheticsymtab in elf32-i386.c and elfx8664getsyntheticsymtab in elf64-x86-64.c.
The getbuildid function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.
The printinsnscore32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the bfddwarf2findnearestline function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.
ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.