There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

An update of the crash package has been released.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: Integer overflow in cplus-dem.c:get_count() allows for denial of service (CVE-2018-18483)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a SECTION type that has a 0 value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.
    Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive     stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg,     demangle_args, and demangle_nested_args. This can occur during execution of nm-new. (CVE-2018-12641)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0934-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-24 (Binutils: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Binutils. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be     processed by the objdump program could cause a null pointer dereference. The greatest threat from this     flaw is to application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1475-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3593-1 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in     elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
    (CVE-2019-12972)

  - An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in     simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant     heap-based buffer overflow. (CVE-2019-14250)

  - apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to     trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as     demonstrated by readelf. (CVE-2019-14444)

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c,     as demonstrated by nm. (CVE-2019-17451)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in pei-x86_64.c. (CVE-2019-9074)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.
    (CVE-2019-9075)

  - An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific     in readelf.c via a malformed MIPS option section. (CVE-2019-9077)

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bindutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted     file to be processed by objdump to cause a NULL pointer     dereference. The greatest threat of this flaw is to     application availability.(CVE-2020-35507)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35507)

  - A flaw was found in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35496)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by the     objdump program could cause a null pointer dereference.
    The greatest threat from this flaw is to application     availability.(CVE-2020-35495)

  - There's a flaw in the BFD library of binutils. An     attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality,     could cause an impact to system availability by way of     excessive memory consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted     file to be processed by objdump to cause a NULL pointer     dereference. The greatest threat of this flaw is to     application availability.(CVE-2020-35507)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35507)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by the     objdump program could cause a null pointer dereference.
    The greatest threat from this flaw is to application     availability.(CVE-2020-35495)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by     binutils could cause usage of uninitialized memory. The     highest threat is to application availability with a     lower threat to data confidentiality.(CVE-2020-35494)

  - A flaw was found in Binutils in bfd/pef.c. This flaw     allows an attacker who can submit a crafted PEF file to     be parsed by objdump to cause a heap buffer overflow,     leading to an out-of-bounds read. The highest threat     from this vulnerability is to system     availability.(CVE-2020-35493)

  - A flaw was found in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35507)

  - A flaw was found in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35496)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the binutils package has been released.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Null Pointer Dereference in debug_get_real_type could     result in DoS(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - There's a flaw in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35507)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - There's a flaw in binutils /bfd/pef.c. An attacker who     is able to submit a crafted input file to be processed     by the objdump program could cause a null pointer     dereference. The greatest threat from this flaw is to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability. This flaw affects binutils versions prior     to 2.34.(CVE-2020-35496)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
200030	RHEL 8 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195378	RHEL 7 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
159175	SUSE SLES15 Security Update : binutils (SUSE-SU-2022:0934-1)	Nessus	SuSE Local Security Checks	high
157002	GLSA-202107-24 : Binutils: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
156515	EulerOS Virtualization 3.0.2.6 : binutils (EulerOS-SA-2021-2903)	Nessus	Huawei Local Security Checks	high
155362	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:1475-1)	Nessus	SuSE Local Security Checks	high
154921	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154898	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154861	SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2021:3593-1)	Nessus	SuSE Local Security Checks	high
151388	EulerOS Virtualization 3.0.2.2 : bindutils (EulerOS-SA-2021-2128)	Nessus	Huawei Local Security Checks	medium
151259	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2021-2045)	Nessus	Huawei Local Security Checks	medium
149585	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-1895)	Nessus	Huawei Local Security Checks	medium
147456	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2021-1388)	Nessus	Huawei Local Security Checks	medium
147036	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-1580)	Nessus	Huawei Local Security Checks	medium
146876	Photon OS 2.0: Binutils PHSA-2021-2.0-0321	Nessus	PhotonOS Local Security Checks	medium
146864	Photon OS 1.0: Binutils PHSA-2021-1.0-0362	Nessus	PhotonOS Local Security Checks	medium
146775	Photon OS 3.0: Binutils PHSA-2021-3.0-0196	Nessus	PhotonOS Local Security Checks	high
145773	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1135)	Nessus	Huawei Local Security Checks	medium
144828	Fedora 32 : mingw-binutils (2020-28c78a6ac3)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-35496

medium

Tenable Plugins

critical

critical

high

critical

high

high

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium