A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

An update of the crash package has been released.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0934-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1475-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3593-1 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in     elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
    (CVE-2019-12972)

  - An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in     simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant     heap-based buffer overflow. (CVE-2019-14250)

  - apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to     trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as     demonstrated by readelf. (CVE-2019-14444)

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c,     as demonstrated by nm. (CVE-2019-17451)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in pei-x86_64.c. (CVE-2019-9074)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.
    (CVE-2019-9075)

  - An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific     in readelf.c via a malformed MIPS option section. (CVE-2019-9077)

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5124-1 advisory.

    It was discovered that GNU binutils incorrectly handled certain hash lookups. An attacker could use this     issue to cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2020-16592)

    It was discovered that GNU binutils incorrectly handled certain corrupt DWARF debug sections. An attacker     could possibly use this issue to cause GNU binutils to consume memory, resulting in a denial of service.
    (CVE-2021-3487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.31. An invalid memory access exists in
    _bfd_stab_section_find_nearest_line in syms.c.
    Attackers could leverage this vulnerability to cause a     denial of service (application crash) via a crafted ELF     file.(CVE-2018-17358)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.31. An invalid memory address dereference     was discovered in read_reloc in reloc.c. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of service, as     demonstrated by objdump, because of missing
    _bfd_clear_contents bounds checking.(CVE-2018-18309)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.31. An invalid memory access exists in     bfd_zalloc in opncls.c. Attackers could leverage this     vulnerability to cause a denial of service (application     crash) via a crafted ELF file.(CVE-2018-17359)

  - GNU gdb All versions is affected by: Buffer Overflow -     Out of bound memory access. The impact is: Deny of     Service, Memory Disclosure, and Possible Code     Execution. The component is: The main gdb module. The     attack vector is: Open an ELF for debugging. The fixed     version is: Not fixed yet.(CVE-2019-1010180)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bindutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted     file to be processed by objdump to cause a NULL pointer     dereference. The greatest threat of this flaw is to     application availability.(CVE-2020-35507)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - The process_version_sections function in readelf.c in     GNU Binutils 2.29 allows attackers to cause a denial of     service (Integer Overflow, and hang because of a     time-consuming loop) or possibly have unspecified other     impact via a crafted binary file with invalid values of     ent.vn_next, during 'readelf -a'     execution.(CVE-2017-14333)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.
    ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was     not a security issue. Notes: none.(CVE-2020-16598)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35507)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by the     objdump program could cause a null pointer dereference.
    The greatest threat from this flaw is to application     availability.(CVE-2020-35495)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by     binutils could cause usage of uninitialized memory. The     highest threat is to application availability with a     lower threat to data confidentiality.(CVE-2020-35494)

  - A flaw was found in Binutils in bfd/pef.c. This flaw     allows an attacker who can submit a crafted PEF file to     be parsed by objdump to cause a heap buffer overflow,     leading to an out-of-bounds read. The highest threat     from this vulnerability is to system     availability.(CVE-2020-35493)

  - A flaw was found in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35507)

  - A flaw was found in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35496)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Null Pointer Dereference in debug_get_real_type could     result in DoS(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35507)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-16592 and CVE-2020-16598

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
195414	RHEL 5 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195378	RHEL 7 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
159175	SUSE SLES15 Security Update : binutils (SUSE-SU-2022:0934-1)	Nessus	SuSE Local Security Checks	high
155362	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:1475-1)	Nessus	SuSE Local Security Checks	high
154921	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154898	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154861	SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2021:3593-1)	Nessus	SuSE Local Security Checks	high
154413	Ubuntu 18.04 LTS / 20.04 LTS : GNU binutils vulnerabilities (USN-5124-1)	Nessus	Ubuntu Local Security Checks	medium
153333	EulerOS 2.0 SP2 : binutils (EulerOS-SA-2021-2355)	Nessus	Huawei Local Security Checks	high
151388	EulerOS Virtualization 3.0.2.2 : bindutils (EulerOS-SA-2021-2128)	Nessus	Huawei Local Security Checks	medium
149165	EulerOS 2.0 SP3 : binutils (EulerOS-SA-2021-1767)	Nessus	Huawei Local Security Checks	high
148067	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-1670)	Nessus	Huawei Local Security Checks	medium
147703	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1646)	Nessus	Huawei Local Security Checks	medium
147574	EulerOS Virtualization 3.0.2.6 : binutils (EulerOS-SA-2021-1408)	Nessus	Huawei Local Security Checks	medium
147560	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-1590)	Nessus	Huawei Local Security Checks	medium
147456	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2021-1388)	Nessus	Huawei Local Security Checks	medium
147451	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2021-1459)	Nessus	Huawei Local Security Checks	medium
147036	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-1580)	Nessus	Huawei Local Security Checks	medium
145773	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1135)	Nessus	Huawei Local Security Checks	medium
144678	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-1021)	Nessus	Huawei Local Security Checks	medium
144668	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-1002)	Nessus	Huawei Local Security Checks	medium
144612	Fedora 33 : mingw-binutils (2020-18ec0bf4bb)	Nessus	Fedora Local Security Checks	medium
144606	Fedora 32 : mingw-binutils (2020-f903e139b1)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-16592

medium

Tenable Plugins

critical

critical

critical

critical

high

high

medium

medium

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium