CVE-2025-11082

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.

Security Fix(es):

A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)

A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es):

• binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11082)

• binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-11082 in the binutils package for Root:Debian:12. Multiple fixed versions available.

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es):

• binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11082)
• binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

• SECURITY UPDATE: segfault in debug_type_samep on crafted input
  • debian/patches/CVE-2025-5245.patch: correct incomplete enum test in debug_type_samep and remove dead code in debug_write_type
  • CVE-2025-5245
• SECURITY UPDATE: segfault in ld on fuzzed object with empty group
  • debian/patches/CVE-2025-5244.patch: add NULL check for first section in elf_gc_sweep to protect against empty group
  • CVE-2025-5244
• SECURITY UPDATE: read beyond .eh_frame section size
  • debian/patches/CVE-2025-11082.patch: use memchr instead of strlen to avoid reading beyond .eh_frame section bounds in _bfd_elf_parse_eh_frame
  • CVE-2025-11082

• SECURITY UPDATE: fix heap buffer overflow in _bfd_elf_parse_eh_frame
  • debian/patches/CVE-2025-11082.patch: fix heap buffer overflow in _bfd_elf_parse_eh_frame
  • CVE-2025-11082
• SECURITY UPDATE: fix NULL deref in elf_gc_sweep with empty groups
  • debian/patches/CVE-2025-5244.patch: fix NULL deref in elf_gc_sweep with empty groups
  • CVE-2025-5244
• SECURITY UPDATE: fix SEGV in debug_type_samep
  • debian/patches/CVE-2025-5245.patch: fix SEGV in debug_type_samep
  • CVE-2025-5245
• SECURITY UPDATE: fix out-of-bounds reads in xcoff_link_add_symbols
  • debian/patches/CVE-2026-3441.patch: properly bounds check XTY_LD x_scnlen index and sanity check r_symndx before using it to index sym hashes in xcoff_link_add_symbols
  • CVE-2026-3441
  • CVE-2026-3442

• CVE-2025-11082: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame

• SECURITY UPDATE: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame
  • debian/patches/CVE-2025-11082.patch: add bounds check before reading buf[1] in the legacy "eh" CIE path
  • CVE-2025-11082

• CVE-2025-11082: Fix heap-based buffer overflow in _bfd_elf_parse_eh_frame triggered by crafted EH frame data; apply patches ea1a0737c769 and e4f355f13be

• CVE-2025-11082: Fix heap-based buffer overflow in _bfd_elf_parse_eh_frame; mitigate local memory corruption risk; apply upstream patches ea1a0737c769 and e4f355f13be

• CVE-2025-11082: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame

• CVE-2025-11082: fix heap buffer overflow in _bfd_elf_parse_eh_frame
• CVE-2025-5244: fix NULL deref in elf_gc_sweep for empty SEC_GROUP
• CVE-2025-5245: fix SEGV in debug_type_samep / debug_write_type
• CVE-2025-7545: fix heap buffer issue in objcopy copy_section
• CVE-2025-7546: fix corrupted group section handling in elf.c

• CVE-2025-11082: fix heap buffer overflow in _bfd_elf_parse_eh_frame
• CVE-2025-5244: fix NULL deref in elf_gc_sweep for empty SEC_GROUP
• CVE-2025-5245: fix SEGV in debug_type_samep / debug_write_type
• CVE-2025-7545: fix heap buffer issue in objcopy copy_section
• CVE-2025-7546: fix corrupted group section handling in elf.c

• CVE-2025-11082: Fix heap-based buffer overflow in _bfd_elf_parse_eh_frame caused by malformed .eh_frame parsing; apply patches ea1a0737c769 and e4f355f13be

• CVE-2021-45078: fix heap-based buffer overflow in stab_xcoff_builtin_type
• CVE-2021-46174: fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: fix heap buffer overflow in find_section_in_set
• CVE-2022-45703: fix heap buffer overflow in display_gdb_index
• CVE-2022-47695: fix segmentation fault in compare_symbols
• CVE-2022-47696: fix DoS in bfd_mach_o_get_synthetic_symtab
• CVE-2022-47673: fix out-of-bounds reads in parse_module
• CVE-2025-11082: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame

• SECURITY UPDATE: memory corruption in ld via fuzzed object
  • debian/patches/CVE-2025-5244.patch: check for empty groups in elf_gc_sweep to prevent NULL pointer dereference
  • CVE-2025-5244
• SECURITY UPDATE: SEGV in objdump function debug_type_samep
  • debian/patches/CVE-2025-5245.patch: handle NULL u.kenum in debug_write_type and debug_type_samep, and add u.kenum->names NULL check to prevent memory corruption
  • CVE-2025-5245
• SECURITY UPDATE: heap-based buffer overflow in _bfd_elf_parse_eh_frame
  • debian/patches/CVE-2025-11082.patch: use bounded memchr search for augmentation NUL terminator instead of unbounded strlen
  • CVE-2025-11082

• CVE-2025-11082: heap buffer overflow in _bfd_elf_parse_eh_frame

These are all security issues fixed in the binutils-2.47-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that GNU binutils incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. The attack is restricted to local execution. (CVE-2025-11082)

It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2025-11083, CVE-2025-5244, CVE-2025-5245, CVE-2025-7554)

It was discovered that GNU binutils incorrectly handled certain files. An attacker could possibly use this issue to cause crash, execute arbitrary code or expose sensitive information. (CVE-2025-1147)

It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-1148, CVE-2025-3198, CVE-2025-8225

It was discovered that GNU binutils incorrectly handled certain files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 25.04. (CVE-2025-1182)

It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbritrary code. This issue only affected Ubuntu 25.04 and Ubuntu 24.04 LTS. (CVE-2025-7546)