GNU Binutils

Field `file_table` of `struct module *module` is uninitialized

Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`

Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized

Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.

A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

GNU Binutils objdump bucomm.c display_info memory leak

GNU Binutils prdbg.c tg_tag_type return value

GNU Binutils ldmisc.c vfinfo out-of-bounds

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

GNU Binutils Linker elf64-x86-64.c elf_x86_64_relocate_section heap-based overflow

GNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereference

GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds

GNU Binutils Linker elfxx-x86.c _bfd_x86_elf_late_size_sections out-of-bounds

GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds

GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds

GNU Binutils objdump.c dump_dwarf_section out-of-bounds

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.

Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

GNU Binutils nm nm.c internal_strlen buffer overflow

GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference

GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption

GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference

GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption

GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow

GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.

Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.

Binutils: binutils: denial of service via crafted elf file

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

GNU Binutils ld xstrdup.c xstrdup memory leak

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.

GNU Binutils DWARF Section dwarf.c process_debug_info memory leak

GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference