CVE-2018-19932 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED...
MediumCVSS 5.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/binutils(Debian:12) | < 2.32.51.20190707-1 | 2.32.51.20190707-1 |
| debian/binutils(Debian:13) | < 2.32.51.20190707-1 | 2.32.51.20190707-1 |
| debian/binutils(Debian:14) | < 2.32.51.20190707-1 | 2.32.51.20190707-1 |
| GNU binutils | <= 2.31 | No fix listed |
| netapp vasa provider | >= 7.2 | No fix listed |
| alpine/binutils(Alpine:v3.10) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.11) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.12) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.13) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.14) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.15) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.16) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.17) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.18) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.19) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.20) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.21) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.22) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.23) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils(Alpine:v3.24) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils-avr(Alpine:v3.11) | < 2.32-r0 | 2.32-r0 |
| alpine/binutils-avr(Alpine:v3.12) | < 2.32-r0 | 2.32-r0 |
References
- Debian Security Tracker CVE-2018-19932 vendor-advisory
- openSUSE-SU-2019:2415 vendor-advisory
- openSUSE-SU-2019:2432 vendor-advisory
- 106144 third-party-advisory vdb-entry
- GLSA-201908-01 vendor-advisory
- security.netapp.com patch third-party-advisory
- sourceware.org exploit issue-tracking patch
- sourceware.org
- USN-4336-1 vendor-advisory
- security.alpinelinux.org vendor-advisory