{"id":"CVE-2020-35494","aliases":["BELL-CVE-2020-35494","DEBIAN-CVE-2020-35494","EUVD-2020-23163","GHSA-4cpw-77g4-8rhj","UBUNTU-CVE-2020-35494"],"status":"published","title":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted...","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01126,"percentile":0.66543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2021-01-04T14:23:23Z","modified":"2026-10-26T12:00:53Z","fixes":[{"ecosystem":"Debian:12","package":"binutils","fixed_in":["2.33.50.20200107-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binutils","fixed_in":["2.33.50.20200107-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.33.50.20200107-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.50.20200107-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.50.20200107-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.50.20200107-1"}]}]}],"products":[{"vendor":"broadcom","product":"brocade_fabric_operating_system_firmware"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"binutils"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"hci_compute_node_firmware"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"netapp","product":"solidfire\\,_enterprise_sds_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1911439","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210212-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202107-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35494"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6"},{"url":"https://security.netapp.com/advisory/ntap-20210212-0007"},{"url":"https://github.com/advisories/GHSA-4cpw-77g4-8rhj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-35494","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35494","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35494","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35494","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2021-01-04T14:23:23Z","modified":"2026-10-08T21:13:58.845Z","cwes":["CWE-908"],"updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23163","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2021-01-04T14:23:23Z","modified":"2026-10-08T21:13:58Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-4cpw-77g4-8rhj","title":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted...","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2022-05-24T17:37:54Z","modified":"2026-10-09T00:32:10Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:12:59.31428Z"}],"nvd":[{"id":"CVE-2020-35494","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2021-01-04T15:15:13.2Z","modified":"2026-10-08T22:16:59.75Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"BELL-CVE-2020-35494","title":"CVE-2020-35494 does not affect BellSoft software","status":"withdrawn","published":"2021-01-04T15:15:00Z","modified":"2026-01-26T09:49:06.483482Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-35494","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2021-01-04T15:15:13.2Z","modified":"2026-10-24T10:31:03.006647654Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35494","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"published","published":"2021-01-04T15:15:13.2Z","modified":"2026-10-26T12:00:53.139373852Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-35494","description":"There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.","status":"withdrawn","published":"2021-01-04T15:15:00Z","modified":"2025-07-16T07:19:34.602077Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"}]}}