Last updated 24 July 2024

In GNU Binutils through version 2.30, the coffpointerizeaux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), an index is not properly validated, allowing an attacker to cause a denial of service via a crash (segmentation fault) when parsing a file with a crafted COFF file.

Upstream Issue:

https://sourceware.org/bugzilla/showbug.cgi?id=22741

Upstream Patch:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eb77f6a4621795367a39cdd30957903af9dbb815

In GNU Binutils 2.30, there's an integer overflow in the function loadspecificdebugsection() in objdump.c, which results in malloc() with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Last updated 24 July 2024

A flaw was found in in GNU libiberty, as distributed in GNU Binutils 2.30. A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in workstuffcopytofrom in cplus-dem.c.

References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102 https://gcc.gnu.org/bugzilla/showbug.cgi?id=85454 https://sourceware.org/bugzilla/showbug.cgi?id=23057

demangletemplate in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.