{"id":"CVE-2016-2226","aliases":["CLSA-2021-1635459139","CLSA-2021-1639670584","CLSA-2021-1640621287","DEBIAN-CVE-2016-2226","DLA-552-1","EUVD-2016-3310","GHSA-pcjp-97ph-pm6p","MGASA-2017-0222","MGASA-2018-0034","MGASA-2018-0046","UBUNTU-CVE-2016-2226","USN-3337-1","USN-3367-1","USN-3368-1","USN-4336-2"],"status":"published","title":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote...","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07234,"percentile":0.94367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119","CWE-190"],"published":"2016-07-18T00:00:00Z","modified":"2026-10-21T10:48:10Z","exploits":[{"source":"exploitdb","id":"EDB-42386","title":"GNU libiberty - Buffer Overflow","type":"dos","platform":"linux","date":"2017-07-27","verified":true,"url":"https://www.exploit-db.com/exploits/42386"}],"fixes":[{"ecosystem":"Debian:12","package":"binutils","fixed_in":["2.27.51.20161102-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binutils","fixed_in":["2.27.51.20161102-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.27.51.20161102-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ht","fixed_in":["2.1.0+repack1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ht","fixed_in":["2.1.0+repack1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ht","fixed_in":["2.1.0+repack1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libiberty","fixed_in":["20161011-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libiberty","fixed_in":["20161011-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libiberty","fixed_in":["20161011-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gdb","fixed_in":["7.7.1-0ubuntu5~14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libiberty","fixed_in":["20131116-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"valgrind","fixed_in":["1:3.10.1-1ubuntu3~14.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gdb","fixed_in":["7.11.1-0ubuntu1~16.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libiberty","fixed_in":["20160215-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"valgrind","fixed_in":["1:3.11.0-1ubuntu4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","fixed_in":["2.26.1-1ubuntu1~16.04.8+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-aarch64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-alpha-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-m68k-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64el-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mipsel-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnuspe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64le-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-s390x-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sh4-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sparc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.0.3.el6.tuxcare.ol.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.0.3.el6.tuxcare.ol.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.1.el6.tuxcare.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.1.el6.tuxcare.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.51.20161102-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.51.20161102-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.51.20161102-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ht","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0+repack1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ht","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0+repack1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ht","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0+repack1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20161011-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20161011-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20161011-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-8+deb7u3"}]}],"versions":["2.22-8","2.22-8+deb7u1","2.22-8+deb7u2"],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"valgrind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1-2.1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.1-7.1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:5","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-12.1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-0ubuntu5~14.04.3"}]}],"versions":["7.6.1-0ubuntu3","7.6.1-1ubuntu1","7.6.50.20131218-0ubuntu1","7.7-0ubuntu1","7.7-0ubuntu2","7.7-0ubuntu3","7.7-0ubuntu3.1","7.7.1-0ubuntu5~14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20131116-1ubuntu0.2"}]}],"versions":["20131116-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"valgrind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.1-1ubuntu3~14.5"}]}],"versions":["1:3.8.1-4ubuntu1","1:3.8.1-5ubuntu1","1:3.8.1-5ubuntu2","1:3.8.1-5ubuntu3","1:3.9.0-4ubuntu1","1:3.9.0-4ubuntu3","1:3.9.0-4ubuntu4","1:3.10~20140411-0ubuntu1","1:3.10.1-1ubuntu3~14.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.52.20130913-0ubuntu1","2.23.90.20131017-1ubuntu1","2.23.90.20131116-1ubuntu1","2.23.91.20131123-1ubuntu1","2.24-1ubuntu1","2.24-1ubuntu2","2.24-2ubuntu1","2.24-2ubuntu2","2.24-2ubuntu3","2.24-4ubuntu1","2.24-5ubuntu1","2.24-5ubuntu2","2.24-5ubuntu3","2.24-5ubuntu3.1","2.24-5ubuntu13","2.24-5ubuntu14","2.24-5ubuntu14.1","2.24-5ubuntu14.2","2.24-5ubuntu14.2+esm1","2.24-5ubuntu14.2+esm2","2.24-5ubuntu14.2+esm3","2.24-5ubuntu14.2+esm5","2.24-5ubuntu14.2+esm6","2.24-5ubuntu14.2+esm7","2.24-5ubuntu14.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.11.1-0ubuntu1~16.5"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160215-1ubuntu0.2"}]}],"versions":["20141014-1","20160215-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"valgrind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.0-1ubuntu4.2"}]}],"versions":["1:3.11.0-1ubuntu1","1:3.11.0-1ubuntu2","1:3.11.0-1ubuntu3","1:3.11.0-1ubuntu4","1:3.11.0-1ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm1"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:4.9.3+svn227297-1","15:4.9.3+svn227297-1build1","15:4.9.3+svn231177-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gccxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0+git20140716-6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ht","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1","2.1.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nescc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0+dfsg-2ubuntu1","3.5.0+dfsg-1","3.5.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10","2.16.1-10build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4ubuntu1","1:3.4.6+dfsg2-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nescc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-1","1.3.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sdcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0+dfsg-2","3.5.0+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4ubuntu3","1:3.4.6+dfsg2-4.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nescc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4.1","1:3.4.6+dfsg2-4.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nescc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-15"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-12"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"binutils-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-10build1","2.16.1-14","2.16.1-15"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gcc-h8300-hms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.4.6+dfsg2-4.2","1:3.4.6+dfsg2-9","1:3.4.6+dfsg2-10","1:3.4.6+dfsg2-11","1:3.4.6+dfsg2-12"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"valgrind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.1-1ubuntu3~14.5"}]}],"versions":["1:3.8.1-4ubuntu1","1:3.8.1-5ubuntu1","1:3.8.1-5ubuntu2","1:3.8.1-5ubuntu3","1:3.9.0-4ubuntu1","1:3.9.0-4ubuntu3","1:3.9.0-4ubuntu4","1:3.10~20140411-0ubuntu1","1:3.10.1-1ubuntu3~14.04"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"valgrind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.0-1ubuntu4.2"}]}],"versions":["1:3.11.0-1ubuntu1","1:3.11.0-1ubuntu2","1:3.11.0-1ubuntu3","1:3.11.0-1ubuntu4","1:3.11.0-1ubuntu4.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-0ubuntu5~14.04.3"}]}],"versions":["7.6.1-0ubuntu3","7.6.1-1ubuntu1","7.6.50.20131218-0ubuntu1","7.7-0ubuntu1","7.7-0ubuntu2","7.7-0ubuntu3","7.7-0ubuntu3.1","7.7.1-0ubuntu5~14.04.2"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.11.1-0ubuntu1~16.5"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20131116-1ubuntu0.2"}]}],"versions":["20131116-1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libiberty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160215-1ubuntu0.2"}]}],"versions":["20141014-1","20160215-1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm1"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8"],"bundled":147}],"products":[{"vendor":"gnu","product":"libiberty"}],"references":[{"url":"https://www.exploit-db.com/exploits/42386/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/90103","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/05/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2226"},{"url":"https://www.exploit-db.com/exploits/42386"},{"url":"https://github.com/advisories/GHSA-pcjp-97ph-pm6p"},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459139","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1639670584.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1640621287.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2226","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0222.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21126","tags":["report"]},{"url":"https://www.ubuntu.com/usn/usn-3337-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0034.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21376","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3367-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0046.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22288","tags":["report"]},{"url":"https://lwn.net/Alerts/694764/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2226","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3337-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3368-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3367-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4336-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-9138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17451","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T20:00:00Z","modified":"2024-08-05T23:24:48.604Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-3310","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T20:00:00Z","modified":"2024-08-05T23:24:48Z","updated_at":"2026-11-03T02:22:54.125931Z"}],"ghsa":[{"id":"GHSA-pcjp-97ph-pm6p","title":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote...","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2022-05-17T02:15:31Z","modified":"2025-04-20T03:33:22Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:40.757238Z"}],"nvd":[{"id":"CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T20:59:00.127Z","modified":"2026-06-17T00:43:42.203Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-190"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T20:59:00Z","modified":"2026-04-16T06:23:37.878241548Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T20:59:00.127Z","modified":"2026-09-22T07:00:42.988399802Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2226","description":"Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.","status":"published","published":"2017-02-24T00:00:00Z","modified":"2026-10-17T12:52:49.406328838Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"CLSA-2021-1635459139","title":"Fix CVE(s): CVE-2018-6323, CVE-2017-8421, CVE-2017-15024, CVE-2017-15025, CVE-2017-15022, CVE-2017-15020, CVE-2017-15021, CVE-2017-15225, CVE-2018-18483, CVE-2017-15996, CVE-2018-18484, CVE-2017-12799, CVE-2017-16831, CVE-2017-16832, CVE-2018-1000876, CVE-2018-7208, CVE-2019-14250, CVE-2017-12967, CVE-2019-9075, CVE-2017-17080, CVE-2019-9074, CVE-2018-17794, CVE-2017-17125, CVE-2017-17124, CVE-2017-17121, CVE-2017-6969, CVE-2017-17123, CVE-2018-17358, CVE-2017-6965, CVE-2017-6966, CVE-2018-12641, CVE-2018-8945, CVE-2017-7299, CVE-2018-12699, CVE-2018-10372, CVE-2018-10373, CVE-2019-17451, CVE-2019-17450, CVE-2018-18701, CVE-2018-18700, CVE-2017-7210, CVE-2018-20623, CVE-2017-15938, CVE-2017-15939, CVE-2017-9039, CVE-2017-9038, CVE-2017-14940, CVE-2018-17985, CVE-2018-12700, CVE-2017-9742, CVE-2017-9745, CVE-2017-9744, CVE-2017-9747, CVE-2017-7209, CVE-2017-9749, CVE-2017-9748, CVE-2018-9138, CVE-2017-16828, CVE-2017-16827, CVE-2017-16826, CVE-2017-7614, CVE-2018-6759, CVE-2016-4491, CVE-2017-9044, CVE-2017-9746, CVE-2017-9042, CVE-2017-9040, CVE-2017-9041, CVE-2017-9752, CVE-2017-9753, CVE-2017-9750, CVE-2017-9751, CVE-2017-9756, CVE-2016-4493, CVE-2017-9754, CVE-2017-9755, CVE-2016-4492, CVE-2018-19932, CVE-2017-12458, CVE-2017-12459, CVE-2018-18606, CVE-2018-18607, CVE-2018-18605, CVE-2017-12452, CVE-2017-12453, CVE-2017-12450, CVE-2017-12451, CVE-2017-12456, CVE-2016-4490, CVE-2017-12454, CVE-2017-12455, CVE-2019-14444, CVE-2016-2226, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2018-18309, CVE-2017-7223, CVE-2017-12449, CVE-2017-12448, CVE-2016-4488, CVE-2016-4489, CVE-2018-17359, CVE-2016-4487, CVE-2018-20671, CVE-2018-20002, CVE-2017-14128, CVE-2017-14129, CVE-2018-7568, CVE-2018-7569, CVE-2017-7302, CVE-2017-7301, CVE-2017-7300, CVE-2018-12934, CVE-2017-8394, CVE-2018-7643, CVE-2018-7642, CVE-2018-17360, CVE-2019-12972, CVE-2018-13033, CVE-2018-19931, CVE-2018-10534, CVE-2018-10535, CVE-2019-9077, CVE-2019-9071, CVE-2019-9070, CVE-2019-9073, CVE-2017-14333, CVE-2018-12698, CVE-2017-14130, CVE-2018-12697, CVE-2018-6543, CVE-2017-9954, CVE-2017-12457, CVE-2017-14939, CVE-2017-14938, CVE-2017-14932, CVE-2017-14930, CVE-2017-8398, CVE-2017-8393, CVE-2017-8395, CVE-2017-14529, CVE-2017-8397, CVE-2017-8396, CVE-2017-13710, CVE-2016-6131","description":"\n   * SECURITY UPDATE:\n     - CVE-*.patch: backported many upstream patches to fix security issues.\n     - CVE-2016-2226, CVE-2016-4487, CVE-2016-4488, CVE-2016-4489,\n       CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131,\n       CVE-2016-4491, CVE-2017-6965, CVE-2017-6966, CVE-2017-6969,\n       CVE-2017-7209, CVE-2017-7210, CVE-2017-7223, CVE-2017-7224,\n       CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2017-7299,\n       CVE-2017-7300, CVE-2017-7301, CVE-2017-7302, CVE-2017-7614,\n       CVE-2017-8393, CVE-2017-8394, CVE-2017-8395, CVE-2017-8397,\n       CVE-2017-8396, CVE-2017-8398, CVE-2017-8421, CVE-2017-9038,\n       CVE-2017-9039, CVE-2017-9040, CVE-2017-9042, CVE-2017-9041,\n       CVE-2017-9044, CVE-2017-9742, CVE-2017-9744, CVE-2017-9752,\n       CVE-2017-9745, CVE-2017-9746, CVE-2017-9747, CVE-2017-9748,\n       CVE-2017-9749, CVE-2017-9750, CVE-2017-9751, CVE-2017-9753,\n       CVE-2017-9754, CVE-2017-9755, CVE-2017-9756, CVE-2017-9954,\n       CVE-2017-12448, CVE-2017-12449, CVE-2017-12455, CVE-2017-12457,\n       CVE-2017-12458, CVE-2017-12459, CVE-2017-12450, CVE-2017-12452,\n       CVE-2017-12453, CVE-2017-12454, CVE-2017-12456, CVE-2017-14333,\n       CVE-2017-12451, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710,\n       CVE-2017-14128, CVE-2017-14129, CVE-2017-14130, CVE-2017-14529,\n       CVE-2017-14930, CVE-2017-14932, CVE-2017-14938, CVE-2017-14939,\n       CVE-2017-14940, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022,\n       CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938,\n       CVE-2017-15939, CVE-2017-15996, CVE-2017-16826, CVE-2017-16827,\n       CVE-2017-16828, CVE-2017-16831, CVE-2017-16832, CVE-2017-17080,\n       CVE-2017-17121, CVE-2017-17123, CVE-2017-17124, CVE-2018-6323,\n       CVE-2018-6543, CVE-2018-6759, CVE-2018-7208, CVE-2018-7568,\n       CVE-2018-7569, CVE-2018-7642, CVE-2018-7643, CVE-2018-8945,\n       CVE-2018-13033, CVE-2018-9138, CVE-2018-12641, CVE-2018-12697,\n       CVE-2018-12698, CVE-2018-12699, CVE-2018-12700, CVE-2018-17794,\n       CVE-2018-17985, CVE-2018-18484, CVE-2018-18700, CVE-2018-18701,\n       CVE-2018-10372, CVE-2018-10373, CVE-2018-10534, CVE-2018-10535,\n       CVE-2018-12934, CVE-2018-18483, CVE-2018-17358, CVE-2018-17359,\n       CVE-2018-17360, CVE-2018-18309, CVE-2018-18605, CVE-2018-18606,\n       CVE-2018-18607, CVE-2018-19931, CVE-2018-19932, CVE-2018-20002,\n       CVE-2018-20623, CVE-2018-20671, CVE-2018-1000876, CVE-2017-17125,\n       CVE-2019-9073, CVE-2019-9074, CVE-2019-9075, CVE-2019-9077,\n       CVE-2019-9070, CVE-2019-9071, CVE-2019-12972, CVE-2019-14250,\n       CVE-2019-14444, CVE-2019-17450, CVE-2019-17451","status":"published","published":"2021-10-28T22:12:19Z","modified":"2026-06-04T10:03:55.348932283Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1639670584","title":"Fixed 36 CVEs in binutils","description":"- CVE-2018-6323: Fix unsigned integer overflow\n- CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in\n- CVE-2018-6543: Fix integer overflow\n- CVE-2018-20671: Fix integer overflow vulnerability\n- CVE-2018-6759: Fix segmentation fault\n- CVE-2018-7208: Fix segmentation fault\n- CVE-2018-7568: Fix integer overflow\n- CVE-2018-7569: Fix integer underflow or overflow\n- CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference\n- CVE-2018-7643: Fix integer overflow\n- CVE-2018-8945: Fix segmentation fault\n- CVE-2018-13033: Fix excessive memory allocation\n- CVE-2018-10373: Fix NULL pointer dereference\n- CVE-2018-10535: Fix NULL pointer dereference\n- CVE-2018-18309: Fix invalid memory address dereference\n- CVE-2018-18605: Fix mishandles section merges\n- CVE-2018-18606: Fix NULL pointer dereference\n- CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd\n- CVE-2018-19932: Fix integer overflow and infinite loop\n- CVE-2018-20002: Fix memory consumption\n- CVE-2018-20623: Fix use-after-free in the error function\n- CVE-2018-1000876: Fix integer overflow trigger heap overflow\n- CVE-2019-9073: Fix excessive memory allocation\n- CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap\n- CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific\n- CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt\n- CVE-2019-14444: Fix integer overflow\n- CVE-2019-17450: Fix infinite recursion\n- CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c\n- CVE-2016-4487: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4488: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4489: Fix integer overflow in libiberty\n- CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty\n- CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty\n- CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal\n- CVE-2016-6131: Fix infinite loop, stack overflow","status":"published","published":"2021-12-16T16:03:04Z","modified":"2026-10-21T10:48:10.857418534Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1640621287","title":"Fix of 36 CVEs","description":"- CVE-2018-6323: Fix unsigned integer overflow\n- CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in\n- CVE-2018-6543: Fix integer overflow\n- CVE-2018-20671: Fix integer overflow vulnerability\n- CVE-2018-6759: Fix segmentation fault\n- CVE-2018-7208: Fix segmentation fault\n- CVE-2018-7568: Fix integer overflow\n- CVE-2018-7569: Fix integer underflow or overflow\n- CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference\n- CVE-2018-7643: Fix integer overflow\n- CVE-2018-8945: Fix segmentation fault\n- CVE-2018-13033: Fix excessive memory allocation\n- CVE-2018-10373: Fix NULL pointer dereference\n- CVE-2018-10535: Fix NULL pointer dereference\n- CVE-2018-18309: Fix invalid memory address dereference\n- CVE-2018-18605: Fix mishandles section merges\n- CVE-2018-18606: Fix NULL pointer dereference\n- CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd\n- CVE-2018-19932: Fix integer overflow and infinite loop\n- CVE-2018-20002: Fix memory consumption\n- CVE-2018-20623: Fix use-after-free in the error function\n- CVE-2018-1000876: Fix integer overflow trigger heap overflow\n- CVE-2019-9073: Fix excessive memory allocation\n- CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap\n- CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific\n- CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt\n- CVE-2019-14444: Fix integer overflow\n- CVE-2019-17450: Fix infinite recursion\n- CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c\n- CVE-2016-4487: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4488: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4489: Fix integer overflow in libiberty\n- CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty\n- CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty\n- CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal\n- CVE-2016-6131: Fix infinite loop, stack overflow","status":"published","published":"2021-12-27T16:08:07Z","modified":"2026-10-21T10:47:15.488395749Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-552-1","title":"binutils - security update","status":"published","published":"2016-07-18T00:00:00Z","modified":"2026-03-09T02:10:13.027024Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2017-0222","title":"Updated valgrind packages fix security vulnerabilities","description":"It was discovered that Valgrind incorectly handled certain string\noperations. If a user or automated system were tricked into processing\na specially crafted binary, a remote attacker could possibly execute\narbitrary code (CVE-2016-2226).\n\nIt was discovered that Valgrind incorrectly handled parsing certain\nbinaries. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to\ncause Valgrind to crash, resulting in a denial of service\n(CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490,\nCVE-2016-4491, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131).\n","status":"published","published":"2017-07-28T18:12:15Z","modified":"2026-04-16T06:24:24.974687688Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2018-0034","title":"Updated gdb packages fix security vulnerability","description":"Hanno Böck discovered that gdb incorrectly handled certain malformed AOUT\nheaders in PE executables. If a user or automated system were tricked into\nprocessing a specially crafted binary, a remote attacker could use this\nissue to cause gdb to crash, resulting in a denial of service, or possibly\nexecute arbitrary code (CVE-2014-8501).\n\nIt was discovered that gdb incorrectly handled printing bad bytes in Intel\nHex objects. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\ngdb to crash, resulting in a denial of service (CVE-2014-9939).\n\nIt was discovered that gdb incorrectly handled certain string operations.\nIf a user or automated system were tricked into processing a specially\ncrafted binary, a remote attacker could use this issue to cause gdb to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode (CVE-2016-2226).\n\nIt was discovered that gdb incorrectly handled parsing certain binaries.\nIf a user or automated system were tricked into processing a specially\ncrafted binary, a remote attacker could use this issue to cause gdb to\ncrash, resulting in a denial of service (CVE-2016-4487, CVE-2016-4488,\nCVE-2016-4489, CVE-2016-4490, CVE-2016-4491, CVE-2016-4492, CVE-2016-4493,\nCVE-2016-6131).\n","status":"published","published":"2018-01-03T14:22:14Z","modified":"2026-04-16T06:24:53.724951923Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0046","title":"Updated binutils packages fix security vulnerability","description":"Exploitable buffer overflow (CVE-2016-2226).\n\nInvalid write due to a use-after-free to array btypevec (CVE-2016-4487).\n\nInvalid write due to a use-after-free to array ktypevec (CVE-2016-4488).\n\nInvalid write due to integer overflow (CVE-2016-4489).\n\nWrite access violation (CVE-2016-4490).\n\nWrite access violations (CVE-2016-4492).\n\nRead access violations (CVE-2016-4493).\n\nStack buffer overflow when printing bad bytes in Intel Hex objects\n(CVE-2016-6131).\n\nreadelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read\nwhile processing corrupt RL78 binaries. The vulnerability can trigger\nprogram crashes. It may lead to an information leak as well\n(CVE-2017-6969).\n\nobjdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer\nover-reads (of size 1 and size 8) while handling corrupt STABS enum type\nstrings in a crafted object file, leading to program crash\n(CVE-2017-7210).\n","status":"published","published":"2018-01-03T14:22:14Z","modified":"2026-04-16T06:24:13.877445216Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"USN-3337-1","title":"valgrind vulnerabilities","description":"It was discovered that Valgrind incorrectly handled certain string\noperations. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04\nLTS and Ubuntu 16.10. (CVE-2016-2226)\n\nIt was discovered that Valgrind incorrectly handled parsing certain\nbinaries. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\nValgrind to crash, resulting in a denial of service. (CVE-2016-4487,\nCVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4491, CVE-2016-4492,\nCVE-2016-4493, CVE-2016-6131)\n","status":"published","published":"2017-06-21T17:37:50Z","modified":"2026-04-27T15:13:51.912165Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3367-1","title":"gdb vulnerabilities","description":"Hanno Böck discovered that gdb incorrectly handled certain malformed AOUT\nheaders in PE executables. If a user or automated system were tricked into\nprocessing a specially crafted binary, a remote attacker could use this\nissue to cause gdb to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only applied to Ubuntu 14.04 LTS.\n(CVE-2014-8501)\n\nIt was discovered that gdb incorrectly handled printing bad bytes in Intel\nHex objects. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\ngdb to crash, resulting in a denial of service. This issue only applied to\nUbuntu 14.04 LTS. (CVE-2014-9939)\n\nIt was discovered that gdb incorrectly handled certain string operations.\nIf a user or automated system were tricked into processing a specially\ncrafted binary, a remote attacker could use this issue to cause gdb to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2016-2226)\n\nIt was discovered that gdb incorrectly handled parsing certain binaries. If\na user or automated system were tricked into processing a specially crafted\nbinary, a remote attacker could use this issue to cause gdb to crash,\nresulting in a denial of service. This issue only applied to Ubuntu 14.04\nLTS and Ubuntu 16.04 LTS. (CVE-2016-4487, CVE-2016-4488, CVE-2016-4489,\nCVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131)\n\nIt was discovered that gdb incorrectly handled parsing certain binaries. If\na user or automated system were tricked into processing a specially crafted\nbinary, a remote attacker could use this issue to cause gdb to crash,\nresulting in a denial of service. (CVE-2016-4491)\n","status":"published","published":"2017-07-26T16:37:24Z","modified":"2026-04-27T15:33:05.598947186Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3368-1","title":"libiberty vulnerabilities","description":"It was discovered that libiberty incorrectly handled certain string\noperations. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\nlibiberty to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2016-2226)\n\nIt was discovered that libiberty incorrectly handled parsing certain\nbinaries. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\nlibiberty to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-4487,\nCVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493,\nCVE-2016-6131)\n\nIt was discovered that libiberty incorrectly handled parsing certain\nbinaries. If a user or automated system were tricked into processing a\nspecially crafted binary, a remote attacker could use this issue to cause\nlibiberty to crash, resulting in a denial of service. (CVE-2016-4491)\n","status":"published","published":"2017-07-26T16:45:14Z","modified":"2026-04-27T15:16:08.955439Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-4336-2","title":"binutils vulnerabilities","description":"USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that GNU binutils contained a large number of security\n issues. If a user or automated system were tricked into processing a\n specially-crafted file, a remote attacker could cause GNU binutils to\n crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2021-07-21T13:08:04Z","modified":"2026-06-25T13:30:12.686756458Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}