{"id":"CVE-2006-2362","aliases":["BELL-CVE-2006-2362","DEBIAN-CVE-2006-2362","EUVD-2006-2363","GHSA-vrm3-57g8-gwv8"],"status":"published","title":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before...","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.14494,"percentile":0.96657,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2006-05-15T16:00:00Z","modified":"2026-10-23T00:00:57Z","exploits":[{"source":"exploitdb","id":"EDB-27856","title":"GNU BinUtils 2.1x - Buffer Overflow","type":"dos","platform":"linux","date":"2006-05-11","verified":true,"url":"https://www.exploit-db.com/exploits/27856"}],"fixes":[{"ecosystem":"Debian:12","package":"binutils","fixed_in":["2.17-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binutils","fixed_in":["2.17-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.17-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-1"}]}]}],"products":[{"vendor":"gnu","product":"binutils"}],"references":[{"url":"http://secunia.com/advisories/20188","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/20550","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/22932","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/27441","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.trustix.org/errata/2006/0034/","tags":["vendor-advisory","x_refsource_TRUSTIX","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/17950","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","Third Party Advisory","VDB Entry","advisory","evidence","fix"]},{"url":"http://www.mail-archive.com/bug-binutils%40gnu.org/msg01516.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","article","report"]},{"url":"http://www.vupen.com/english/advisories/2007/3665","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://www.novell.com/linux/security/advisories/2006_26_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/1924","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://www.securitytracker.com/id?1018872","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://secunia.com/advisories/20531","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/usn-292-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Broken Link","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26644","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://sourceware.org/bugzilla/show_bug.cgi?id=2584","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-2362"},{"url":"http://www.mail-archive.com/bug-binutils@gnu.org/msg01516.html"},{"url":"http://www.trustix.org/errata/2006/0034"},{"url":"https://github.com/advisories/GHSA-vrm3-57g8-gwv8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2006-2362","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-2362","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-2362","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2006-05-15T16:00:00Z","modified":"2025-01-16T20:05:47.171Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:33:48.871799Z"}],"euvd":[{"id":"EUVD-2006-2363","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2006-05-15T16:00:00Z","modified":"2025-01-16T20:05:47Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:04:18.077485Z"}],"ghsa":[{"id":"GHSA-vrm3-57g8-gwv8","title":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before...","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2022-05-01T06:58:18Z","modified":"2025-01-16T21:31:59Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:35.190753Z"}],"nvd":[{"id":"CVE-2006-2362","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2006-05-15T16:06:00Z","modified":"2026-06-16T22:24:51.267Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:01:02.98271Z"}],"osv":[{"id":"BELL-CVE-2006-2362","title":"CVE-2006-2362 does not affect BellSoft software","status":"withdrawn","published":"2006-05-15T16:06:00Z","modified":"2026-01-26T09:48:35.0339Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:12.886815Z"},{"id":"DEBIAN-CVE-2006-2362","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2006-05-15T16:06:00Z","modified":"2026-10-23T00:00:57.400412419Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:23.105674Z"},{"id":"CVE-2006-2362","description":"Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.","status":"published","published":"2006-05-15T16:06:00Z","modified":"2026-04-10T03:37:33.62191Z","updated_at":"2026-11-02T15:43:56.581247Z"}]}}