The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

An update of the crash package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to     cause a denial of service (out-of-bounds read) via a small S-record. (CVE-2014-8484)

  - The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers     in an ELF file. (CVE-2014-8485)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to     cause a denial of service (out-of-bounds read) via a small S-record. (CVE-2014-8484)

  - The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers     in an ELF file. (CVE-2014-8485)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of     bounds heap read via a crafted vms file. (CVE-2017-12449)

  - The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote     attackers to cause an out of bounds stack read via a crafted COFF image file. (CVE-2017-12451)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

An update of the binutils package has been released.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
200048	RHEL 6 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199993	RHEL 5 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199956	RHEL 7 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195414	RHEL 5 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195378	RHEL 7 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
121805	Photon OS 1.0: Binutils PHSA-2018-1.0-0104	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2017-13716

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

medium