Veracode Vulnerability DatabaseVERACODE:37228Heap-buffer-overflow
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:N/A:P
0.0005 Low
EPSS
Percentile
16.3%
binutils, edge is vulnerable to a heap buffer overflow. The vulnerability exists in bfd_getl32 function when called from the strip_main function in strip-new via a malicious file.
References
github.com/bminor/binutils-gdb/commit/45d92439aebd0386ef8af76e1796d08cfe457e1d
lists.fedoraproject.org/archives/list/[email protected]/message/6AKZ2DTS3ATVN5PANNVLKLE5OP4OF25Q/
lists.fedoraproject.org/archives/list/[email protected]/message/7MTEHT3G6YKJ7F7MSGWYSI4UM3XBAYXZ/
secdb.alpinelinux.org/edge/main.yaml
security.netapp.com/advisory/ntap-20221104-0007/
sourceware.org/bugzilla/show_bug.cgi?id=29482
sourceware.org/bugzilla/show_bug.cgi?id=29482#c2
sourceware.org/bugzilla/show_bug.cgi?id=29495
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=45d92439aebd0386ef8af76e1796d08cfe457e1d
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:N/A:P
0.0005 Low
EPSS
Percentile
16.3%