K38336243: Binutils vulnerabilities CVE-2018-20623, CVE-2018-20651, and CVE-2018-20712

Security Advisory Description CVE-2018-20623 In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the processarchive function in readelf.c via a crafted ELF file. CVE-2018-20651 A NULL pointer dereference was discovered in elflinkaddobjectsymbols i...

SUSE CVE-2017-9778

GNU Debugger GDB 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GDB to repeatedly allocate memory until a process limit is reached. This can, for example, impede efforts to analyze malware with GDB...

SUSE CVE-2017-14930

Memory leak in decodelineinfo in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service memory consumption via a crafted ELF file...

SUSE CVE-2017-16830

The printgnupropertynote function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service segmentation violation and application crash or possibly have unspecified other impact via a crafted ELF...

SUSE CVE-2017-16829

The bfdelfparsegnuproperties function in elf-properties.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service out-of-bounds read and application crash or possibl...

SUSE CVE-2018-13033

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service excessive memory allocation and application crash via a crafted ELF file, as demonstrated by bfdelfparseattributes in elf-attrs.c and bfdmalloc in libbfd.c...

SUSE CVE-2018-18701

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions nextistypequal and cplusdemangletype in cp-demangle.c. Remote attackers could leverage this vulnerability t...

The vulnerability of the GNU Binutils development tool, related to the handling of zero pointers, allows an attacker to execute a type of attack known as a “Denial-of-Service” (DoS) attack.

The vulnerability of the GNU Binutils development tool is related to a memory access error. Exploiting this vulnerability could allow an attacker to perform a type of attack known as a “Denial-of-Service” DoS attack while analyzing ELF files containing corrupted version information about symbols...

OPENSUSE-SU-2023:0031-1 Security update for upx

upx was updated to fix the following issues: - CVE-2023-23457: Fixed a segmentation fault when processing malicious elf files boo1207122 Update to release 4.0.1 Fix crash when a linux/armeb LZMA-packed binary unpacks itself. Resolve 'CantPackException: bad ElfXXShdrs' with staticly-linked program...

ToaruOS Code Execution Vulnerability

ToaruOS is an open source computer operating system written in the C language. A code execution vulnerability exists in ToaruOS version 2.0.1, which stems from a global overflow in readelf, and can be exploited to remotely execute code while parsing a specially crafted ELF file...

ToaruOS 缓冲区错误漏洞

ToaruOS is an open source computer operating system written in the C language. A security vulnerability exists in ToaruOS version 2.0.1, which stems from some arbitrary address read vulnerabilities in its readelf when parsing carefully crafted ELF files...

Ubuntu: Security Advisory (USN-3686-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-21711 Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special...

Elfspirit 缓冲区错误漏洞

Elfspirit is a Chinese Elf static analysis and injection framework . It is used to parse, manipulate and disguise Elf files. A security vulnerability exists in elfspirit, which stems from a read out-of-bounds error that could cause an attacker to crash the application or disclose information...

LinuxCatScale - Incident Response Collection And Processing Scripts With Automated Reporting Scripts

Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process. Usage This script...

ELFant in the Room – capa v3

Since our initial public release of capa, incident responders and reverse engineers have used the tool to automatically identify capabilities in Windows executables. With our newest code and ruleset updates, capa v3 also identifies capabilities in Executable and Linkable Format ELF files, such as...

Huawei EulerOS: Security Advisory for file (EulerOS-SA-2021-2116)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EQGRP

This is a repository containing the decrypted content of eqgrp-auction-file.tar.xz. The repository appears to be a Linux binary repository, containing ELF files for 7z, 7za, and 7z.so. The ELF files are likely related to the 7-Zip file archiver. The repository does not contain any obvious...

UPX Denial of Service Vulnerability (CNVD-2021-24268)

UPX is an open source executable file packaging program that supports a variety of file formats from different operating systems. A denial of service vulnerability exists in canPack in plxelf.cpp in UPX version 3.96. An attacker can exploit this vulnerability to cause the application to crash via...

USN-3911-2: file regression

USN-3911-1 fixed vulnerabilities in file. One of the backported security fixes introduced a regression that caused the interpreter string to be truncated. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that file incorrectly handled...