An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangletemplatevalueparm, demangleintegralvalue, and demangleexpression.
An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demanglenestedargs, demangleargs, doarg, and dotype.
binutils through version 2.30 has a vulnerability in the elf.c:bfdsectionfromshdr() functionof the Binary File Descriptor (BFD) library (aka libbfd). An attacker could exploit this with a crafted executable file to cause a crash.
Upstream Bug:
https://sourceware.org/bugzilla/showbug.cgi?id=22809
Upstream Patch:
https://sourceware.org/bugzilla/attachment.cgi?id=10814&action=diff
Last updated 24 July 2024
The assignfilepositionsfornonloadsections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy.
A flaw was found in the parsedie function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils up to version 2.30, when compiled in 32bit mode. This vulnerability allows attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupted dwarf1 debug information.
References: https://sourceware.org/bugzilla/showbug.cgi?id=22894
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eef104664efb52965d85a28bc3fc7c77e52e48e2
A flaw was found in the readattributevalue function in dwarf2.c file in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils up to version 2.30, when compiled in 32bit mode. This allows attackers to cause a denial of service (integer wraparound and application crash) via an ELF file with a corrupt DWARF FORM block.
References: https://sourceware.org/bugzilla/showbug.cgi?id=22895
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=12c963421d045a127c413a0722062b9932c50aa9
The elfparsenotes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.
Last updated 24 July 2024
A flaw was found in the bfdXXbfdcopyprivatebfddatacommon function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (externalIMAGEDEBUGDIRECTORY) edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with bfdpex64bfdcopyprivatebfddatacommon in pex64igen.c.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23110
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aa4a8c2a2a67545e90c877162c53cc9de42dc8b4
A flaw was found in the ignoresectionsym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the outputsection pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23113
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=db0c309f4011ca94a4abc8458e27f3734dab92ac
GNU Binutils through version 2.30 has a heap-based buffer over-read vulnerability in dwarf.c:processcutuindex(). An attacker could exploit this to crash the readelf application by providing a binary file.
Upstream Issue:
https://sourceware.org/bugzilla/showbug.cgi?id=23064
Upstream Patch:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6aea08d9f3e3d6475a65454da488a0c51f5dc97d
concatfilename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.
A flaw was found in The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file. This can occur during execution of nm.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23361