CVE-2018-18605

A heap-based buffer over-read issue was discovered in the function
sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD)
library (aka libbfd), as distributed in GNU Binutils 2.31, because
_bfd_add_merge_section mishandles section merges when size is not a
multiple of entsize. A specially crafted ELF allows remote attackers to
cause a denial of service, as demonstrated by ld.

Bugs

• <https://sourceware.org/bugzilla/show_bug.cgi?id=23804&gt;