Medium severity · published Oct 10, 2019
CVE-2019-17451
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32
6.5
CVSS
2.4%
EPSS
No
On KEV
Description
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Binutils · Gnu
2.32 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
UL
Ubuntu Linux · Canonical
18.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17451
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html
Third Party Advisory
https://security.gentoo.org/glsa/202007-39
Third Party Advisory
https://security.netapp.com/advisory/ntap-20191024-0002/
Exploit
https://sourceware.org/bugzilla/show_bug.cgi?id=25070
sourceware.org
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=336bfbeb1848f4b9558456fdcf283ee8a32d7fd1
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation