{"id":"CVE-2018-18309","aliases":["BELL-CVE-2018-18309","CLSA-2021-1635459139","CLSA-2021-1639670584","CLSA-2021-1640621287","DEBIAN-CVE-2018-18309","EUVD-2018-10042","GHSA-cqf4-rwmp-9g9j","SUSE-SU-2019:2650-1","SUSE-SU-2019:2779-1","SUSE-SU-2019:2780-1","UBUNTU-CVE-2018-18309","USN-4336-1","USN-4336-2","openSUSE-SU-2019:2415-1","openSUSE-SU-2019:2432-1","openSUSE-SU-2024:10651-1"],"status":"published","title":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed...","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0182,"percentile":0.78888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-10-15T02:00:00Z","modified":"2026-10-24T10:30:32Z","fixes":[{"ecosystem":"Debian:12","package":"binutils","fixed_in":["2.32.51.20190707-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binutils","fixed_in":["2.32.51.20190707-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.32.51.20190707-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","fixed_in":["2.26.1-1ubuntu1~16.04.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"binutils","fixed_in":["2.30-21ubuntu1~18.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-aarch64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-alpha-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-m68k-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64el-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mipsel-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnuspe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64le-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-s390x-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sh4-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sparc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10"}]}],"bundled":147},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.0.3.el6.tuxcare.ol.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.0.3.el6.tuxcare.ol.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.1.el6.tuxcare.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.20.51.0.2-5.48.1.el6.tuxcare.els3"}]}],"bundled":36},{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.51.20190707-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.51.20190707-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.51.20190707-1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"cross-ppc-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"cross-spu-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cross-ppc-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cross-spu-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-9.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-7.5.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-7.5.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-7.5.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-6.8.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-6.8.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-6.8.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.52.20130913-0ubuntu1","2.23.90.20131017-1ubuntu1","2.23.90.20131116-1ubuntu1","2.23.91.20131123-1ubuntu1","2.24-1ubuntu1","2.24-1ubuntu2","2.24-2ubuntu1","2.24-2ubuntu2","2.24-2ubuntu3","2.24-4ubuntu1","2.24-5ubuntu1","2.24-5ubuntu2","2.24-5ubuntu3","2.24-5ubuntu3.1","2.24-5ubuntu13","2.24-5ubuntu14","2.24-5ubuntu14.1","2.24-5ubuntu14.2","2.24-5ubuntu14.2+esm1","2.24-5ubuntu14.2+esm2","2.24-5ubuntu14.2+esm3","2.24-5ubuntu14.2+esm5","2.24-5ubuntu14.2+esm6","2.24-5ubuntu14.2+esm7","2.24-5ubuntu14.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm1"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-21ubuntu1~18.04.3"}]}],"versions":["2.29.1-4ubuntu1","2.29.1-6ubuntu1","2.29.1-7ubuntu1","2.29.1-8ubuntu1","2.29.1-10ubuntu1","2.29.1-12ubuntu1","2.30-4ubuntu1","2.30-5ubuntu1","2.30-7ubuntu1","2.30-8ubuntu1","2.30-9ubuntu1","2.30-10ubuntu1","2.30-11ubuntu1","2.30-14ubuntu2","2.30-15ubuntu1","2.30-20ubuntu2~18.04","2.30-21ubuntu1~18.04","2.30-21ubuntu1~18.04.1","2.30-21ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-21ubuntu1~18.04.3"}]}],"versions":["2.29.1-4ubuntu1","2.29.1-6ubuntu1","2.29.1-7ubuntu1","2.29.1-8ubuntu1","2.29.1-10ubuntu1","2.29.1-12ubuntu1","2.30-4ubuntu1","2.30-5ubuntu1","2.30-7ubuntu1","2.30-8ubuntu1","2.30-9ubuntu1","2.30-10ubuntu1","2.30-11ubuntu1","2.30-14ubuntu2","2.30-15ubuntu1","2.30-20ubuntu2~18.04","2.30-21ubuntu1~18.04","2.30-21ubuntu1~18.04.1","2.30-21ubuntu1~18.04.2"],"bundled":44},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm1"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8"],"bundled":147},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp150.10.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-aarch64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-arm-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-avr-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-epiphany-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-hppa-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-hppa64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-i386-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-ia64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-m68k-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-mips-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-ppc-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-ppc64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-ppc64le-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-riscv64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-rx-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-s390-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-s390x-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-sparc-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-sparc64-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cross-spu-binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32-lp151.3.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37-1.3"}]}],"bundled":106}],"products":[{"vendor":"gnu","product":"binutils"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=23770","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/105692","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0930cb3021b8078b34cf216e79eb8608d017864f","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4336-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18309"},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0930cb3021b8078b34cf216e79eb8608d017864f"},{"url":"https://github.com/advisories/GHSA-cqf4-rwmp-9g9j"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-18309","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459139","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1639670584.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1640621287.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18309","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192650-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109412","tags":["report"]},{"url":"https://bugzilla.suse.com/1109413","tags":["report"]},{"url":"https://bugzilla.suse.com/1109414","tags":["report"]},{"url":"https://bugzilla.suse.com/1111996","tags":["report"]},{"url":"https://bugzilla.suse.com/1112534","tags":["report"]},{"url":"https://bugzilla.suse.com/1112535","tags":["report"]},{"url":"https://bugzilla.suse.com/1113247","tags":["report"]},{"url":"https://bugzilla.suse.com/1113252","tags":["report"]},{"url":"https://bugzilla.suse.com/1113255","tags":["report"]},{"url":"https://bugzilla.suse.com/1116827","tags":["report"]},{"url":"https://bugzilla.suse.com/1118830","tags":["report"]},{"url":"https://bugzilla.suse.com/1118831","tags":["report"]},{"url":"https://bugzilla.suse.com/1120640","tags":["report"]},{"url":"https://bugzilla.suse.com/1121034","tags":["report"]},{"url":"https://bugzilla.suse.com/1121035","tags":["report"]},{"url":"https://bugzilla.suse.com/1121056","tags":["report"]},{"url":"https://bugzilla.suse.com/1133131","tags":["report"]},{"url":"https://bugzilla.suse.com/1133232","tags":["report"]},{"url":"https://bugzilla.suse.com/1141913","tags":["report"]},{"url":"https://bugzilla.suse.com/1142772","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010180","tags":["web"]},{"url":"https://bugzilla.suse.com/ECO-368","tags":["report"]},{"url":"https://bugzilla.suse.com/SLE-6206","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118644","tags":["report"]},{"url":"https://bugzilla.suse.com/1152590","tags":["report"]},{"url":"https://bugzilla.suse.com/1154016","tags":["report"]},{"url":"https://bugzilla.suse.com/1154025","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8945","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192780-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18309","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4336-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4336-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-9138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18607","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4492","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12451","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12452","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7643","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z3JUZNUB5MLFYPANGJ7Z7AR432VRY6KN/#Z3JUZNUB5MLFYPANGJ7Z7AR432VRY6KN","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SWUEZJ7AYL2LKLBXPYPMQQS6C42W3MB6/#SWUEZJ7AYL2LKLBXPYPMQQS6C42W3MB6","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-18309","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:00:00Z","modified":"2024-08-05T11:08:21.339Z","updated_at":"2026-11-02T14:35:12.160284Z"}],"euvd":[{"id":"EUVD-2018-10042","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:00:00Z","modified":"2024-08-05T11:08:21Z","updated_at":"2026-11-03T02:39:36.74767Z"}],"ghsa":[{"id":"GHSA-cqf4-rwmp-9g9j","title":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed...","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2022-05-13T01:30:47Z","modified":"2023-02-01T05:07:55Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:38.356016Z"}],"nvd":[{"id":"CVE-2018-18309","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:29:00.767Z","modified":"2026-06-17T01:46:57.79Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:44.873741Z"}],"osv":[{"id":"BELL-CVE-2018-18309","title":"CVE-2018-18309 does not affect BellSoft software","status":"withdrawn","published":"2018-10-15T02:29:00Z","modified":"2026-01-26T09:49:15.857696Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-18309","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:29:00.767Z","modified":"2026-10-24T10:30:32.6764303Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18309","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:29:00.767Z","modified":"2026-10-23T18:03:02.185071198Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18309","description":"An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.","status":"published","published":"2018-10-15T02:29:00Z","modified":"2026-04-22T11:49:37.721039Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"CLSA-2021-1635459139","title":"Fix CVE(s): CVE-2018-6323, CVE-2017-8421, CVE-2017-15024, CVE-2017-15025, CVE-2017-15022, CVE-2017-15020, CVE-2017-15021, CVE-2017-15225, CVE-2018-18483, CVE-2017-15996, CVE-2018-18484, CVE-2017-12799, CVE-2017-16831, CVE-2017-16832, CVE-2018-1000876, CVE-2018-7208, CVE-2019-14250, CVE-2017-12967, CVE-2019-9075, CVE-2017-17080, CVE-2019-9074, CVE-2018-17794, CVE-2017-17125, CVE-2017-17124, CVE-2017-17121, CVE-2017-6969, CVE-2017-17123, CVE-2018-17358, CVE-2017-6965, CVE-2017-6966, CVE-2018-12641, CVE-2018-8945, CVE-2017-7299, CVE-2018-12699, CVE-2018-10372, CVE-2018-10373, CVE-2019-17451, CVE-2019-17450, CVE-2018-18701, CVE-2018-18700, CVE-2017-7210, CVE-2018-20623, CVE-2017-15938, CVE-2017-15939, CVE-2017-9039, CVE-2017-9038, CVE-2017-14940, CVE-2018-17985, CVE-2018-12700, CVE-2017-9742, CVE-2017-9745, CVE-2017-9744, CVE-2017-9747, CVE-2017-7209, CVE-2017-9749, CVE-2017-9748, CVE-2018-9138, CVE-2017-16828, CVE-2017-16827, CVE-2017-16826, CVE-2017-7614, CVE-2018-6759, CVE-2016-4491, CVE-2017-9044, CVE-2017-9746, CVE-2017-9042, CVE-2017-9040, CVE-2017-9041, CVE-2017-9752, CVE-2017-9753, CVE-2017-9750, CVE-2017-9751, CVE-2017-9756, CVE-2016-4493, CVE-2017-9754, CVE-2017-9755, CVE-2016-4492, CVE-2018-19932, CVE-2017-12458, CVE-2017-12459, CVE-2018-18606, CVE-2018-18607, CVE-2018-18605, CVE-2017-12452, CVE-2017-12453, CVE-2017-12450, CVE-2017-12451, CVE-2017-12456, CVE-2016-4490, CVE-2017-12454, CVE-2017-12455, CVE-2019-14444, CVE-2016-2226, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2018-18309, CVE-2017-7223, CVE-2017-12449, CVE-2017-12448, CVE-2016-4488, CVE-2016-4489, CVE-2018-17359, CVE-2016-4487, CVE-2018-20671, CVE-2018-20002, CVE-2017-14128, CVE-2017-14129, CVE-2018-7568, CVE-2018-7569, CVE-2017-7302, CVE-2017-7301, CVE-2017-7300, CVE-2018-12934, CVE-2017-8394, CVE-2018-7643, CVE-2018-7642, CVE-2018-17360, CVE-2019-12972, CVE-2018-13033, CVE-2018-19931, CVE-2018-10534, CVE-2018-10535, CVE-2019-9077, CVE-2019-9071, CVE-2019-9070, CVE-2019-9073, CVE-2017-14333, CVE-2018-12698, CVE-2017-14130, CVE-2018-12697, CVE-2018-6543, CVE-2017-9954, CVE-2017-12457, CVE-2017-14939, CVE-2017-14938, CVE-2017-14932, CVE-2017-14930, CVE-2017-8398, CVE-2017-8393, CVE-2017-8395, CVE-2017-14529, CVE-2017-8397, CVE-2017-8396, CVE-2017-13710, CVE-2016-6131","description":"\n   * SECURITY UPDATE:\n     - CVE-*.patch: backported many upstream patches to fix security issues.\n     - CVE-2016-2226, CVE-2016-4487, CVE-2016-4488, CVE-2016-4489,\n       CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131,\n       CVE-2016-4491, CVE-2017-6965, CVE-2017-6966, CVE-2017-6969,\n       CVE-2017-7209, CVE-2017-7210, CVE-2017-7223, CVE-2017-7224,\n       CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2017-7299,\n       CVE-2017-7300, CVE-2017-7301, CVE-2017-7302, CVE-2017-7614,\n       CVE-2017-8393, CVE-2017-8394, CVE-2017-8395, CVE-2017-8397,\n       CVE-2017-8396, CVE-2017-8398, CVE-2017-8421, CVE-2017-9038,\n       CVE-2017-9039, CVE-2017-9040, CVE-2017-9042, CVE-2017-9041,\n       CVE-2017-9044, CVE-2017-9742, CVE-2017-9744, CVE-2017-9752,\n       CVE-2017-9745, CVE-2017-9746, CVE-2017-9747, CVE-2017-9748,\n       CVE-2017-9749, CVE-2017-9750, CVE-2017-9751, CVE-2017-9753,\n       CVE-2017-9754, CVE-2017-9755, CVE-2017-9756, CVE-2017-9954,\n       CVE-2017-12448, CVE-2017-12449, CVE-2017-12455, CVE-2017-12457,\n       CVE-2017-12458, CVE-2017-12459, CVE-2017-12450, CVE-2017-12452,\n       CVE-2017-12453, CVE-2017-12454, CVE-2017-12456, CVE-2017-14333,\n       CVE-2017-12451, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710,\n       CVE-2017-14128, CVE-2017-14129, CVE-2017-14130, CVE-2017-14529,\n       CVE-2017-14930, CVE-2017-14932, CVE-2017-14938, CVE-2017-14939,\n       CVE-2017-14940, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022,\n       CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938,\n       CVE-2017-15939, CVE-2017-15996, CVE-2017-16826, CVE-2017-16827,\n       CVE-2017-16828, CVE-2017-16831, CVE-2017-16832, CVE-2017-17080,\n       CVE-2017-17121, CVE-2017-17123, CVE-2017-17124, CVE-2018-6323,\n       CVE-2018-6543, CVE-2018-6759, CVE-2018-7208, CVE-2018-7568,\n       CVE-2018-7569, CVE-2018-7642, CVE-2018-7643, CVE-2018-8945,\n       CVE-2018-13033, CVE-2018-9138, CVE-2018-12641, CVE-2018-12697,\n       CVE-2018-12698, CVE-2018-12699, CVE-2018-12700, CVE-2018-17794,\n       CVE-2018-17985, CVE-2018-18484, CVE-2018-18700, CVE-2018-18701,\n       CVE-2018-10372, CVE-2018-10373, CVE-2018-10534, CVE-2018-10535,\n       CVE-2018-12934, CVE-2018-18483, CVE-2018-17358, CVE-2018-17359,\n       CVE-2018-17360, CVE-2018-18309, CVE-2018-18605, CVE-2018-18606,\n       CVE-2018-18607, CVE-2018-19931, CVE-2018-19932, CVE-2018-20002,\n       CVE-2018-20623, CVE-2018-20671, CVE-2018-1000876, CVE-2017-17125,\n       CVE-2019-9073, CVE-2019-9074, CVE-2019-9075, CVE-2019-9077,\n       CVE-2019-9070, CVE-2019-9071, CVE-2019-12972, CVE-2019-14250,\n       CVE-2019-14444, CVE-2019-17450, CVE-2019-17451","status":"published","published":"2021-10-28T22:12:19Z","modified":"2026-06-04T10:03:55.348932283Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1639670584","title":"Fixed 36 CVEs in binutils","description":"- CVE-2018-6323: Fix unsigned integer overflow\n- CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in\n- CVE-2018-6543: Fix integer overflow\n- CVE-2018-20671: Fix integer overflow vulnerability\n- CVE-2018-6759: Fix segmentation fault\n- CVE-2018-7208: Fix segmentation fault\n- CVE-2018-7568: Fix integer overflow\n- CVE-2018-7569: Fix integer underflow or overflow\n- CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference\n- CVE-2018-7643: Fix integer overflow\n- CVE-2018-8945: Fix segmentation fault\n- CVE-2018-13033: Fix excessive memory allocation\n- CVE-2018-10373: Fix NULL pointer dereference\n- CVE-2018-10535: Fix NULL pointer dereference\n- CVE-2018-18309: Fix invalid memory address dereference\n- CVE-2018-18605: Fix mishandles section merges\n- CVE-2018-18606: Fix NULL pointer dereference\n- CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd\n- CVE-2018-19932: Fix integer overflow and infinite loop\n- CVE-2018-20002: Fix memory consumption\n- CVE-2018-20623: Fix use-after-free in the error function\n- CVE-2018-1000876: Fix integer overflow trigger heap overflow\n- CVE-2019-9073: Fix excessive memory allocation\n- CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap\n- CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific\n- CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt\n- CVE-2019-14444: Fix integer overflow\n- CVE-2019-17450: Fix infinite recursion\n- CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c\n- CVE-2016-4487: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4488: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4489: Fix integer overflow in libiberty\n- CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty\n- CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty\n- CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal\n- CVE-2016-6131: Fix infinite loop, stack overflow","status":"published","published":"2021-12-16T16:03:04Z","modified":"2026-10-21T10:48:10.857418534Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1640621287","title":"Fix of 36 CVEs","description":"- CVE-2018-6323: Fix unsigned integer overflow\n- CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in\n- CVE-2018-6543: Fix integer overflow\n- CVE-2018-20671: Fix integer overflow vulnerability\n- CVE-2018-6759: Fix segmentation fault\n- CVE-2018-7208: Fix segmentation fault\n- CVE-2018-7568: Fix integer overflow\n- CVE-2018-7569: Fix integer underflow or overflow\n- CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference\n- CVE-2018-7643: Fix integer overflow\n- CVE-2018-8945: Fix segmentation fault\n- CVE-2018-13033: Fix excessive memory allocation\n- CVE-2018-10373: Fix NULL pointer dereference\n- CVE-2018-10535: Fix NULL pointer dereference\n- CVE-2018-18309: Fix invalid memory address dereference\n- CVE-2018-18605: Fix mishandles section merges\n- CVE-2018-18606: Fix NULL pointer dereference\n- CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd\n- CVE-2018-19932: Fix integer overflow and infinite loop\n- CVE-2018-20002: Fix memory consumption\n- CVE-2018-20623: Fix use-after-free in the error function\n- CVE-2018-1000876: Fix integer overflow trigger heap overflow\n- CVE-2019-9073: Fix excessive memory allocation\n- CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap\n- CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific\n- CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt\n- CVE-2019-14444: Fix integer overflow\n- CVE-2019-17450: Fix infinite recursion\n- CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c\n- CVE-2016-4487: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4488: Fix use-after-free vulnerability in libiberty\n- CVE-2016-4489: Fix integer overflow in libiberty\n- CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty\n- CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty\n- CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal\n- CVE-2016-6131: Fix infinite loop, stack overflow","status":"published","published":"2021-12-27T16:08:07Z","modified":"2026-10-21T10:47:15.488395749Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"openSUSE-SU-2019:2415-1","title":"Security update for binutils","description":"This update for binutils fixes the following issues:\n\nbinutils was updated to current 2.32 branch [jsc#ECO-368].\n\nIncludes following security fixes:\n\n- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)\n- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)\n- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)\n- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)\n- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)\n- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)\n- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)\n- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)\n- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)\n- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)\n- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)\n- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)\n- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)\n- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)\n- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in  load_specific_debug_section in objdump.c (bsc#1121056)\n- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)\n- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)\n\n- enable xtensa architecture (Tensilica lc6 and related)\n- Use -ffat-lto-objects in order to provide assembly for static libs\n  (bsc#1141913).\n- Fixed some LTO build issues (bsc#1133131 bsc#1133232).\n- riscv: Don't check ABI flags if no code section\n- Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).\n- Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).\n\nUpdate to binutils 2.32:\n\n* The binutils now support for the C-SKY processor series.\n* The x86 assembler now supports a -mvexwig=[0|1] option to control\n  encoding of VEX.W-ignored (WIG) VEX instructions.\n  It also has a new -mx86-used-note=[yes|no] option to generate (or\n  not) x86 GNU property notes.  \n* The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),\n  the Loongson EXTensions (EXT) instructions, the Loongson Content\n  Address Memory (CAM) ASE and the Loongson MultiMedia extensions\n  Instructions (MMI) ASE.\n* The addr2line, c++filt, nm and objdump tools now have a default\n  limit on the maximum amount of recursion that is allowed whilst\n  demangling strings.  This limit can be disabled if necessary.\n* Objdump's --disassemble option can now take a parameter,\n  specifying the starting symbol for disassembly.  Disassembly will\n  continue from this symbol up to the next symbol or the end of the\n  function.\n* The BFD linker will now report property change in linker map file\n  when merging GNU properties.\n* The BFD linker's -t option now doesn't report members within\n  archives, unless -t is given twice.  This makes it more useful\n  when generating a list of files that should be packaged for a\n  linker bug report.\n* The GOLD linker has improved warning messages for relocations that\n  refer to discarded sections.\n\n- Improve relro support on s390 [fate#326356]\n- Fix broken debug symbols (bsc#1118644)\n- Handle ELF compressed header alignment correctly.\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-30T17:25:53Z","modified":"2026-02-04T03:05:23.612391Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2432-1","title":"Security update for binutils","description":"This update for binutils fixes the following issues:\n\nbinutils was updated to current 2.32 branch [jsc#ECO-368].\n\nIncludes following security fixes:\n\n- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)\n- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)\n- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)\n- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)\n- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)\n- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)\n- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)\n- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)\n- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)\n- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)\n- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)\n- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)\n- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)\n- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)\n- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in  load_specific_debug_section in objdump.c (bsc#1121056)\n- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)\n- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)\n\n- enable xtensa architecture (Tensilica lc6 and related)\n- Use -ffat-lto-objects in order to provide assembly for static libs\n  (bsc#1141913).\n- Fixed some LTO build issues (bsc#1133131 bsc#1133232).\n- riscv: Don't check ABI flags if no code section\n- Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).\n- Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).\n\nUpdate to binutils 2.32:\n\n* The binutils now support for the C-SKY processor series.\n* The x86 assembler now supports a -mvexwig=[0|1] option to control\n  encoding of VEX.W-ignored (WIG) VEX instructions.\n  It also has a new -mx86-used-note=[yes|no] option to generate (or\n  not) x86 GNU property notes.  \n* The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),\n  the Loongson EXTensions (EXT) instructions, the Loongson Content\n  Address Memory (CAM) ASE and the Loongson MultiMedia extensions\n  Instructions (MMI) ASE.\n* The addr2line, c++filt, nm and objdump tools now have a default\n  limit on the maximum amount of recursion that is allowed whilst\n  demangling strings.  This limit can be disabled if necessary.\n* Objdump's --disassemble option can now take a parameter,\n  specifying the starting symbol for disassembly.  Disassembly will\n  continue from this symbol up to the next symbol or the end of the\n  function.\n* The BFD linker will now report property change in linker map file\n  when merging GNU properties.\n* The BFD linker's -t option now doesn't report members within\n  archives, unless -t is given twice.  This makes it more useful\n  when generating a list of files that should be packaged for a\n  linker bug report.\n* The GOLD linker has improved warning messages for relocations that\n  refer to discarded sections.\n\n- Improve relro support on s390 [fate#326356]\n- Fix broken debug symbols (bsc#1118644)\n- Handle ELF compressed header alignment correctly.\n\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-11-05T15:30:18Z","modified":"2026-02-04T04:06:56.482283Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10651-1","title":"binutils-2.37-1.3 on GA media","description":"These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:04.564666Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2650-1","title":"Security update for binutils","description":"This update for binutils fixes the following issues:\n\nbinutils was updated to current 2.32 branch @7b468db3 [jsc#ECO-368]:\n\nIncludes the following security fixes:\n\n- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)\n- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)\n- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)\n- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)\n- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)\n- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)\n- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)\n- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)\n- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)\n- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)\n- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)\n- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)\n- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)\n- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)\n- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in  load_specific_debug_section in objdump.c (bsc#1121056)\n- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)\n- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)\n\n- Enable xtensa architecture (Tensilica lc6 and related)\n- Use -ffat-lto-objects in order to provide assembly for static libs\n  (bsc#1141913).\n- Fixed some LTO problems (bsc#1133131 bsc#1133232).\n- riscv: Don't check ABI flags if no code section\n\nUpdate to binutils 2.32:\n\n* The binutils now support for the C-SKY processor series.\n* The x86 assembler now supports a -mvexwig=[0|1] option to control\n  encoding of VEX.W-ignored (WIG) VEX instructions.\n  It also has a new -mx86-used-note=[yes|no] option to generate (or\n  not) x86 GNU property notes.\n* The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),\n  the Loongson EXTensions (EXT) instructions, the Loongson Content\n  Address Memory (CAM) ASE and the Loongson MultiMedia extensions\n  Instructions (MMI) ASE.\n* The addr2line, c++filt, nm and objdump tools now have a default\n  limit on the maximum amount of recursion that is allowed whilst\n  demangling strings.  This limit can be disabled if necessary.\n* Objdump's --disassemble option can now take a parameter,\n  specifying the starting symbol for disassembly.  Disassembly will\n  continue from this symbol up to the next symbol or the end of the\n  function.\n* The BFD linker will now report property change in linker map file\n  when merging GNU properties.\n* The BFD linker's -t option now doesn't report members within\n  archives, unless -t is given twice.  This makes it more useful\n  when generating a list of files that should be packaged for a\n  linker bug report.\n* The GOLD linker has improved warning messages for relocations that\n  refer to discarded sections.\n\n- Improve relro support on s390 [fate#326356]\n- Handle ELF compressed header alignment correctly.\n\n  ","status":"published","published":"2019-10-14T08:53:28Z","modified":"2026-02-04T03:43:03.821299Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2779-1","title":"Security update for binutils","description":"This update for binutils fixes the following issues:\n\nbinutils was updated to current 2.32 branch [jsc#ECO-368].\n\nIncludes following security fixes:\n\n- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)\n- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)\n- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)\n- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)\n- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)\n- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)\n- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)\n- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)\n- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)\n- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)\n- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)\n- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)\n- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)\n- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)\n- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in  load_specific_debug_section in objdump.c (bsc#1121056)\n- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)\n- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)\n\n- enable xtensa architecture (Tensilica lc6 and related)\n- Use -ffat-lto-objects in order to provide assembly for static libs\n  (bsc#1141913).\n- Fixed some LTO build issues (bsc#1133131 bsc#1133232).\n- riscv: Don't check ABI flags if no code section\n- Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).\n- Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).\n\nUpdate to binutils 2.32:\n\n* The binutils now support for the C-SKY processor series.\n* The x86 assembler now supports a -mvexwig=[0|1] option to control\n  encoding of VEX.W-ignored (WIG) VEX instructions.\n  It also has a new -mx86-used-note=[yes|no] option to generate (or\n  not) x86 GNU property notes.  \n* The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),\n  the Loongson EXTensions (EXT) instructions, the Loongson Content\n  Address Memory (CAM) ASE and the Loongson MultiMedia extensions\n  Instructions (MMI) ASE.\n* The addr2line, c++filt, nm and objdump tools now have a default\n  limit on the maximum amount of recursion that is allowed whilst\n  demangling strings.  This limit can be disabled if necessary.\n* Objdump's --disassemble option can now take a parameter,\n  specifying the starting symbol for disassembly.  Disassembly will\n  continue from this symbol up to the next symbol or the end of the\n  function.\n* The BFD linker will now report property change in linker map file\n  when merging GNU properties.\n* The BFD linker's -t option now doesn't report members within\n  archives, unless -t is given twice.  This makes it more useful\n  when generating a list of files that should be packaged for a\n  linker bug report.\n* The GOLD linker has improved warning messages for relocations that\n  refer to discarded sections.\n\n- Improve relro support on s390 [fate#326356]\n- Fix broken debug symbols (bsc#1118644)\n- Handle ELF compressed header alignment correctly.\n\n","status":"published","published":"2019-10-24T14:57:52Z","modified":"2026-02-04T02:19:25.340033Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2780-1","title":"Security update for binutils","description":"This update for binutils fixes the following issues:\n\nbinutils was updated to current 2.32 branch [jsc#ECO-368].\n\nIncludes following security fixes:\n\n- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)\n- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)\n- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)\n- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)\n- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)\n- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)\n- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)\n- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)\n- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)\n- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)\n- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)\n- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)\n- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)\n- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)\n- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in  load_specific_debug_section in objdump.c (bsc#1121056)\n- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)\n- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)\n\n- enable xtensa architecture (Tensilica lc6 and related)\n- Use -ffat-lto-objects in order to provide assembly for static libs\n  (bsc#1141913).\n- Fixed some LTO build issues (bsc#1133131 bsc#1133232).\n- riscv: Don't check ABI flags if no code section\n- Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).\n- Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).\n\nUpdate to binutils 2.32:\n\n* The binutils now support for the C-SKY processor series.\n* The x86 assembler now supports a -mvexwig=[0|1] option to control\n  encoding of VEX.W-ignored (WIG) VEX instructions.\n  It also has a new -mx86-used-note=[yes|no] option to generate (or\n  not) x86 GNU property notes.  \n* The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),\n  the Loongson EXTensions (EXT) instructions, the Loongson Content\n  Address Memory (CAM) ASE and the Loongson MultiMedia extensions\n  Instructions (MMI) ASE.\n* The addr2line, c++filt, nm and objdump tools now have a default\n  limit on the maximum amount of recursion that is allowed whilst\n  demangling strings.  This limit can be disabled if necessary.\n* Objdump's --disassemble option can now take a parameter,\n  specifying the starting symbol for disassembly.  Disassembly will\n  continue from this symbol up to the next symbol or the end of the\n  function.\n* The BFD linker will now report property change in linker map file\n  when merging GNU properties.\n* The BFD linker's -t option now doesn't report members within\n  archives, unless -t is given twice.  This makes it more useful\n  when generating a list of files that should be packaged for a\n  linker bug report.\n* The GOLD linker has improved warning messages for relocations that\n  refer to discarded sections.\n\n- Improve relro support on s390 [fate#326356]\n- Fix broken debug symbols (bsc#1118644)\n- Handle ELF compressed header alignment correctly.\n\n","status":"published","published":"2019-10-25T12:25:52Z","modified":"2026-02-04T04:13:25.87103Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4336-1","title":"binutils vulnerabilities","description":"It was discovered that GNU binutils contained a large number of security\nissues. If a user or automated system were tricked into processing a\nspecially-crafted file, a remote attacker could cause GNU binutils to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2020-04-22T11:40:31Z","modified":"2026-04-27T15:48:42.817786021Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4336-2","title":"binutils vulnerabilities","description":"USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that GNU binutils contained a large number of security\n issues. If a user or automated system were tricked into processing a\n specially-crafted file, a remote attacker could cause GNU binutils to\n crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2021-07-21T13:08:04Z","modified":"2026-06-25T13:30:12.686756458Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}