It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-334 advisory.

  - Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in     file readelf.c. (CVE-2022-45703)

  - An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out     of bound reads which may cause a denial of service or other unspecified impacts. (CVE-2022-47673)

  - An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or     other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c. (CVE-2022-47695)

  - An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or     other unspecified impacts via function compare_symbols. (CVE-2022-47696)

  - GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the     function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a     DNS attack. (CVE-2022-48063)

  - GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the     function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file     and cause a DNS attack. (CVE-2022-48064)

  - GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function     find_abstract_instance in dwarf2.c. (CVE-2022-48065)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : binutils, binutils-devel, binutils-gprofng (ALAS2023-2023-334)

high Nessus Plugin ID 181155

Version 1.1

Version 1.0

Version 1.1 Sep 8, 2023, 4:12 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309081612
Version 1.0 Sep 8, 2023, 8:11 AM New Plugin Feed: 202309080811