SB2024011543 - Multiple vulnerabilities in GNU Binutils

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024011543

SB2024011543 - Multiple vulnerabilities in GNU Binutils

Published: January 15, 2024 Updated: March 5, 2024

Security Bulletin ID SB2024011543
Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2022-45703)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the display_debug_section() function in readelf.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Heap-based buffer overflow (CVE-ID: CVE-2022-44840)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the find_section_in_set() function in readelf.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Memory leak (CVE-ID: CVE-2022-48065)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the find_abstract_instance() function in dwarf2.c. A remote attacker can force the application to leak memory and perform denial of service attack.


4) Input validation error (CVE-ID: CVE-2022-47695)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the bfd_mach_o_get_synthetic_symtab() function in match-o.c in objdump. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


5) Resource exhaustion (CVE-ID: CVE-2022-48064)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the bfd_dwarf2_find_nearest_line_with_alt() function in dwarf2.c. A remote attacker can trigger resource exhaustion via a crafted ELF file and perform a denial of service (DoS) attack.


6) Out-of-bounds read (CVE-ID: CVE-2022-47673)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the parse_module() function in addr2line. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.


7) Input validation error (CVE-ID: CVE-2022-47696)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the compare_symbols() function in objdump. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


8) Out-of-bounds read (CVE-ID: CVE-2023-25584)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the parse_module() function in bfd/vms-alpha.c. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References