An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out     of bound reads which may cause a denial of service or other unspecified impacts.(CVE-2022-47673)

    An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in     Binutils.(CVE-2023-25584)

    Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in     file readelf.c.(CVE-2022-44840)

Tenable has extracted the preceding description block directly from the EulerOS binutils security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the binutils package has been released.

An update of the gdb package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to     cause a denial of service (out-of-bounds read) via a small S-record. (CVE-2014-8484)

  - The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers     in an ELF file. (CVE-2014-8485)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: Integer overflow in cplus-dem.c:get_count() allows for denial of service (CVE-2018-18483)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a SECTION type that has a 0 value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.
    Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive     stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg,     demangle_args, and demangle_nested_args. This can occur during execution of nm-new. (CVE-2018-12641)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of     bounds heap read via a crafted vms file. (CVE-2017-12449)

  - The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote     attackers to cause an out of bounds stack read via a crafted COFF image file. (CVE-2017-12451)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.
    (CVE-2023-25584)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.
    (CVE-2023-25584)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6101-1 advisory.

    It was discovered that GNU binutils incorrectly handled certain DWARF files. An attacker could possibly     use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 22.10.
    (CVE-2023-1579)

    It was discovered that GNU binutils did not properly verify the version definitions in zer0-lengthverdef     table. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue     only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-1972)

    It was discovered that GNU binutils did not properly validate the size of length parameter in vms-alpha.
    An attacker could possibly use this issue to cause a crash or access sensitive information. This issue     only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2023-25584)

    It was discovered that GNU binutils did not properly initialized the file_table field of struct module and     the_bfd field of asymbol. An attacker could possibly use this issue to cause a crash. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2023-25585, CVE-2023-25588)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207638	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2024-2457)	Nessus	Huawei Local Security Checks	high
204564	Photon OS 4.0: Binutils PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	high
204554	Photon OS 5.0: Gdb PHSA-2023-5.0-0060	Nessus	PhotonOS Local Security Checks	critical
204288	Photon OS 4.0: Gdb PHSA-2023-4.0-0440	Nessus	PhotonOS Local Security Checks	high
204096	Photon OS 3.0: Binutils PHSA-2023-3.0-0604	Nessus	PhotonOS Local Security Checks	high
204059	Photon OS 3.0: Gdb PHSA-2023-3.0-0686	Nessus	PhotonOS Local Security Checks	high
203542	Photon OS 5.0: Binutils PHSA-2023-5.0-0087	Nessus	PhotonOS Local Security Checks	high
202944	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2024-2019)	Nessus	Huawei Local Security Checks	high
200048	RHEL 6 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
200030	RHEL 8 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199956	RHEL 7 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195456	RHEL 6 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195444	RHEL 8 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195378	RHEL 7 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
188557	EulerOS 2.0 SP11 : binutils (EulerOS-SA-2023-2832)	Nessus	Huawei Local Security Checks	high
188499	EulerOS Virtualization 2.11.0 : binutils (EulerOS-SA-2023-3065)	Nessus	Huawei Local Security Checks	high
188490	EulerOS 2.0 SP11 : binutils (EulerOS-SA-2023-2827)	Nessus	Huawei Local Security Checks	high
188479	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2023-2950)	Nessus	Huawei Local Security Checks	high
188312	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2023-2976)	Nessus	Huawei Local Security Checks	high
188295	EulerOS Virtualization 2.10.0 : binutils (EulerOS-SA-2023-2931)	Nessus	Huawei Local Security Checks	high
188284	EulerOS Virtualization 2.10.1 : binutils (EulerOS-SA-2023-2912)	Nessus	Huawei Local Security Checks	high
188174	EulerOS 2.0 SP10 : binutils (EulerOS-SA-2023-2803)	Nessus	Huawei Local Security Checks	high
188116	EulerOS 2.0 SP10 : binutils (EulerOS-SA-2023-2779)	Nessus	Huawei Local Security Checks	high
188109	EulerOS Virtualization 2.11.1 : binutils (EulerOS-SA-2023-3048)	Nessus	Huawei Local Security Checks	high
179554	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2023-2603)	Nessus	Huawei Local Security Checks	high
179517	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2023-2573)	Nessus	Huawei Local Security Checks	high
176325	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : GNU binutils vulnerabilities (USN-6101-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-25584

high

Tenable Plugins

high

high

critical

high

high

high

high

high

critical

high

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high