7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
52.1%
Severity: High
Date : 2019-06-04
CVE-ID : CVE-2018-19931 CVE-2018-19932 CVE-2018-20002 CVE-2018-20712
Package : binutils
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-832
The package binutils before version 2.32-1 is vulnerable to multiple
issues including arbitrary code execution and denial of service.
Upgrade to 2.32-1.
The problems have been fixed upstream in version 2.32.
None.
An issue was discovered in the Binary File Descriptor (BFD) library
(aka libbfd), as distributed in GNU Binutils through 2.31. There is a
heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h
because the number of program headers is not restricted.
An issue was discovered in the Binary File Descriptor (BFD) library
(aka libbfd), as distributed in GNU Binutils through 2.31. There is an
integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA
macro in elf.c.
The _bfd_generic_read_minisymbols function in syms.c in the Binary File
Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils
2.31, has a memory leak via a crafted ELF file, leading to a denial of
service (memory consumption), as demonstrated by nm.
A heap-based buffer over-read exists in the function d_expression_1 in
cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1.
A crafted input can cause segmentation faults, leading to denial-of-
service, as demonstrated by c++filt.
An attacker is able to crash or execute arbitrary code on a process
that uses libbfd functions by providing a malicious object file.
https://www.securityfocus.com/bid/106144
https://www.securityfocus.com/bid/106142
https://sourceware.org/bugzilla/show_bug.cgi?id=23942
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d181371d67534fa273dd221df20c07
https://sourceware.org/bugzilla/show_bug.cgi?id=23932
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=beab453223769279cc1cef68a1622ab8978641f7
https://sourceware.org/bugzilla/show_bug.cgi?id=23952
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c2f5dc30afa34696f2da0081c4ac50b958ecb0e9
http://www.securityfocus.com/bid/106563
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629
https://sourceware.org/bugzilla/show_bug.cgi?id=24043
https://security.archlinux.org/CVE-2018-19931
https://security.archlinux.org/CVE-2018-19932
https://security.archlinux.org/CVE-2018-20002
https://security.archlinux.org/CVE-2018-20712
www.securityfocus.com/bid/106563
gcc.gnu.org/bugzilla/show_bug.cgi?id=88629
security.archlinux.org/AVG-832
security.archlinux.org/CVE-2018-19931
security.archlinux.org/CVE-2018-19932
security.archlinux.org/CVE-2018-20002
security.archlinux.org/CVE-2018-20712
sourceware.org/bugzilla/show_bug.cgi?id=23932
sourceware.org/bugzilla/show_bug.cgi?id=23942
sourceware.org/bugzilla/show_bug.cgi?id=23952
sourceware.org/bugzilla/show_bug.cgi?id=24043
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d181371d67534fa273dd221df20c07
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=beab453223769279cc1cef68a1622ab8978641f7
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c2f5dc30afa34696f2da0081c4ac50b958ecb0e9
www.securityfocus.com/bid/106142
www.securityfocus.com/bid/106144
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
52.1%