The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

An update of the crash package has been released.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gcc: integer overflow flaws in libgfortran (CVE-2014-5044)

  - Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
    (CVE-2002-2439)

  - Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to     execute arbitrary code via a crafted executable, which triggers a buffer overflow. (CVE-2016-2226)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Developer environment: Homoglyph characters can lead to trojan source attack (CVE-2021-42694)

  - The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has     a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated     by cxxfilt, a related issue to CVE-2018-12698. (CVE-2018-20657)

  - The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1,     contains an integer overflow vulnerability (for Create an array for saving the template argument values)     that can trigger a heap-based buffer overflow, as demonstrated by nm. (CVE-2018-20673)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gcc: integer overflow flaws in libgfortran (CVE-2014-5044)

  - The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not     properly handle short reads from blocking sources, which makes it easier for context-dependent attackers     to predict the random values via unspecified vectors. (CVE-2015-5276)

  - Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to     execute arbitrary code via a crafted executable, which triggers a buffer overflow. (CVE-2016-2226)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gcc: integer overflow flaws in libgfortran (CVE-2014-5044)

  - Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
    (CVE-2002-2439)

  - The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not     properly handle short reads from blocking sources, which makes it easier for context-dependent attackers     to predict the random values via unspecified vectors. (CVE-2015-5276)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3352 advisory.

    [8.2-6.el8]
    - Fix yum vs dnf messaging for RHEL8 (RH BZ 1666249):
      Add gdb-rhbz1666249-suggest-yum-instead-of-dnf.pattch       Do not define DNF_DEBUGINFO_INSTALL for RHEL.
    - Backport 'Remove support for old mangling schemes'       (Simon Marchi, RH BZ 1668635)
    - Backport 'Add checks for the NT_ARM_SVE section in a core file.'       (Alan Hayward, RH BZ 1669953)
    - Backport more Power8 support (IBM, RH BZ 1187581)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3352 advisory.

  - libiberty: Memory leak in demangle_template function resulting in a denial of service (CVE-2018-20657)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The gcc package contains the GNU Compiler Collection     version 4.8.You'll need this package in order to     compile C code.Security Fix(es):The demangle_template     function in cplus-dem.c in GNU libiberty, as     distributed in GNU Binutils 2.31.1, has a memory leak     via a crafted string, leading to a denial of service     (memory consumption), as demonstrated by cxxfilt, a     related issue to CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gcc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the     response header, an attacker can exploit it to insert a     newline character to split a header, and inject     malicious content to deceive clients. NOTE: this issue     exists because of an incomplete fix for CVE-2017-17742,     which addressed the CRLF vector, but did not address an     isolated CR or an isolated LF.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9074)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-14250)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

  - The _bfd_generic_read_minisymbols function in syms.c in     the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.31, has a memory leak     via a crafted ELF file, leading to a denial of service     (memory consumption), as demonstrated by     nm.(CVE-2018-20002)

  - apply_relocations in readelf.c in GNU Binutils 2.32     contains an integer overflow that allows attackers to     trigger a write access violation (in     byte_put_little_endian function in elfcomm.c) via an     ELF file, as demonstrated by readelf.(CVE-2019-14444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1,     contains an integer overflow vulnerability (for 'Create     an array for saving the template argument values') that     can trigger a heap-based buffer overflow, as     demonstrated by nm.(CVE-2018-20673)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - GNU gdb All versions is affected by: Buffer Overflow -     Out of bound memory access. The impact is: Deny of     Service, Memory Disclosure, and Possible Code     Execution. The component is: The main gdb module. The     attack vector is: Open an ELF for debugging. The fixed     version is: Not fixed yet.(CVE-2019-1010180)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3352 advisory.

    The GNU Debugger (GDB) allows users to debug programs written in various programming languages including     C, C++, and Fortran.

    Security Fix(es):

    * libiberty: Memory leak in demangle_template function resulting in a denial of service (CVE-2018-20657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
198425	RHEL 5 : gcc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198411	RHEL 8 : gcc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198409	RHEL 7 : gcc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198339	RHEL 6 : gcc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196191	RHEL 6 : libiberty (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196156	RHEL 7 : libiberty (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196135	RHEL 8 : libiberty (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
180781	Oracle Linux 8 : gdb (ELSA-2019-3352)	Nessus	Oracle Linux Local Security Checks	high
145633	CentOS 8 : gdb (CESA-2019:3352)	Nessus	CentOS Local Security Checks	high
140896	EulerOS 2.0 SP3 : gcc (EulerOS-SA-2020-2129)	Nessus	Huawei Local Security Checks	high
140888	EulerOS 2.0 SP3 : gdb (EulerOS-SA-2020-2121)	Nessus	Huawei Local Security Checks	high
137945	EulerOS Virtualization 3.0.6.0 : gcc (EulerOS-SA-2020-1726)	Nessus	Huawei Local Security Checks	high
136251	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2020-1548)	Nessus	Huawei Local Security Checks	high
135628	EulerOS Virtualization 3.0.2.2 : binutils (EulerOS-SA-2020-1466)	Nessus	Huawei Local Security Checks	critical
135150	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2020-1363)	Nessus	Huawei Local Security Checks	high
133976	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2020-1142)	Nessus	Huawei Local Security Checks	high
133895	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2020-1094)	Nessus	Huawei Local Security Checks	high
130530	RHEL 8 : gdb (RHSA-2019:3352)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-20657

high

Tenable Plugins

critical

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

high

high

high