CVE-2020-16592

MEDIUM5.5

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2

Published Dec 9, 2020

Modified 1 years ago

Details

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

References

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKIMSD5FIC3QFJDKNHR2PSO6JYJGCLHB/

WEB

https://security.netapp.com/advisory/ntap-20210115-0003/

WEB

https://sourceware.org/bugzilla/show_bug.cgi?id=25823

WEB

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7ecb51549ab1ec22aba5aaf34b70323cf0b8509a

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2020-16592

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.5/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedDec 9, 2020

ModifiedAug 4, 2024

CVE-2020-16592 | Mondoo Vulnerability Intelligence