GNU Binutils 安全漏洞

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

CVE-2021-35134

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2022-21711

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special...

CVE-2024-21462

Transient DOS while loading the TA ELF file...

CVE-2024-42381

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which...

PT-2025-6161

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43 Description A critical issue affects the function bfd elf gc mark rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The...

CLSA-2025-1738663576 kernel: Fix of 11 CVEs

ELF: fix kernel.randomizevaspace double read CVE-2024-46826 - smb: client: fix UAF in async decryption CVE-2024-50047 - SMB3: Resolve data corruption of TCP server info fields CVE-2024-50047 - smb3: add defines for new crypto algorithms CVE-2024-50047 - net: do not delay dstentriesadd in...

CVE-2024-42936

The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message...

PT-2025-2639

Name of the Vulnerable Software and Affected Versions Ruijie RG-EW300N firmware versions prior to 1.300.1422 Description The mqlink.elf service component in Ruijie RG-EW300N is susceptible to Remote Code Execution through a crafted MQTT broker message. The issue involves the processing of modifie...

radare2:ia_fuzz: Heap-use-after-free in Elf32_free

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=4646859695521792 Project: radare2 Fuzzing Engine: honggfuzz Fuzz Target: iafuzz Job Type: honggfuzzasanradare2 Platform Id: linux Crash Type:...

New Glutton Malware Exploits Popular PHP Frameworks Like Laravel and ThinkPHP

Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States, Cambodia, Pakistan, and South Africa. QiAnXin XLab, which discovered the malicious activity in late April 2024, attributed the previously...

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c.

...

llvm:llvm-isel-fuzzer--aarch64-O2: Heap-buffer-overflow in llvm::AArch64_ELFTargetObjectFile::emitPersonalityValueImpl

Detailed Report: https://oss-fuzz.com/testcase?key=5649153771765760 Project: llvm Fuzzing Engine: honggfuzz Fuzz Target: llvm-isel-fuzzer--aarch64-O2 Job Type: honggfuzzasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x512000071b48 Crash State:...

kernel: x86/kexec: Fix double-free of elf header buffer

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 "x86/kexec: fix memory leak of elf header buffer", freeing image-elfheaders in the error path of crashloadsegments is not needed because kimagefilepostloadcleanup...

file:magic_fuzzer_fd: Stack-buffer-overflow in dophn_exec

Project: https://github.com/file/file.git Detailed Report: https://oss-fuzz.com/testcase?key=6501920811843584 Project: file Fuzzing Engine: afl Fuzz Target: magicfuzzerfd Job Type: aflasanfile Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7a6e8ae4c300 Crash State:...

orbit:ElfFileLoadSymbolsFuzzer: Heap-buffer-overflow in llvm::object::Elf_Note_Iterator_Impl<llvm::object::ELFType<

Detailed Report: https://oss-fuzz.com/testcase?key=6259649989443584 Project: orbit Fuzzing Engine: libFuzzer Fuzz Target: ElfFileLoadSymbolsFuzzer Job Type: libfuzzerasanorbit Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x612000000c3f Crash State:...

kernel-rt security update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

gcc-toolset-14-dwz bug fix and enhancement update

An update is available for gcc-toolset-14-dwz. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dwz package contains a program that attempts to optimize DWARF...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

kernel: ELF: fix kernel.randomize_va_space double read

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses "randomizevaspace" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly on...