{"id":"CVE-2023-25584","aliases":["BELL-CVE-2023-25584","CLSA-2023-1687795384","CLSA-2025-1761847256","CLSA-2026-1776430866","CLSA-2026-1777059908","DEBIAN-CVE-2023-25584","EUVD-2023-29526","GHSA-xgv8-vx7r-x752","UBUNTU-CVE-2023-25584","USN-6101-1"],"status":"published","title":"Out of bounds read in parse_module function in bfd/vms-alpha.c","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00379,"percentile":0.32348,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-02-15T00:00:00Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Debian:12","package":"binutils","fixed_in":["2.39.50.20221224-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binutils","fixed_in":["2.39.50.20221224-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.39.50.20221224-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"binutils","fixed_in":["2.30-21ubuntu1~18.04.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"binutils","fixed_in":["2.34-6ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"binutils","fixed_in":["2.38-4ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-aarch64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-alpha-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-arm-linux-gnueabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-hppa64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-m68k-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mips64el-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-mipsel-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-multiarch-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc-linux-gnuspe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-powerpc64le-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-s390x-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sh4-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"binutils-sparc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.10+tuxcare.els6"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-aarch64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-alpha-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-arm-linux-gnueabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-arm-linux-gnueabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-for-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-for-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-hppa-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-hppa64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-i686-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-i686-kfreebsd-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-i686-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-ia64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-m68k-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-mips-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-mips64el-linux-gnuabi64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-mipsel-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-multiarch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-multiarch-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-powerpc-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-powerpc-linux-gnuspe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-powerpc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-powerpc64le-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-riscv64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-s390x-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-sh4-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-sparc64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-x86-64-kfreebsd-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-x86-64-linux-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"binutils-x86-64-linux-gnux32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libbinutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-16+tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils-gold","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els7"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-123.el8.tuxcare.els10"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-123.el8.tuxcare.els10"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.50.20221224-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.50.20221224-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.50.20221224-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.52.20130913-0ubuntu1","2.23.90.20131017-1ubuntu1","2.23.90.20131116-1ubuntu1","2.23.91.20131123-1ubuntu1","2.24-1ubuntu1","2.24-1ubuntu2","2.24-2ubuntu1","2.24-2ubuntu2","2.24-2ubuntu3","2.24-4ubuntu1","2.24-5ubuntu1","2.24-5ubuntu2","2.24-5ubuntu3","2.24-5ubuntu3.1","2.24-5ubuntu13","2.24-5ubuntu14","2.24-5ubuntu14.1","2.24-5ubuntu14.2","2.24-5ubuntu14.2+esm1","2.24-5ubuntu14.2+esm2","2.24-5ubuntu14.2+esm3","2.24-5ubuntu14.2+esm5","2.24-5ubuntu14.2+esm6","2.24-5ubuntu14.2+esm7","2.24-5ubuntu14.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8","2.26.1-1ubuntu1~16.04.8+esm1","2.26.1-1ubuntu1~16.04.8+esm3","2.26.1-1ubuntu1~16.04.8+esm4","2.26.1-1ubuntu1~16.04.8+esm5","2.26.1-1ubuntu1~16.04.8+esm6","2.26.1-1ubuntu1~16.04.8+esm7","2.26.1-1ubuntu1~16.04.8+esm9","2.26.1-1ubuntu1~16.04.8+esm11","2.26.1-1ubuntu1~16.04.8+esm12","2.26.1-1ubuntu1~16.04.8+esm13","2.26.1-1ubuntu1~16.04.8+esm14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-21ubuntu1~18.04.9"}]}],"versions":["2.29.1-4ubuntu1","2.29.1-6ubuntu1","2.29.1-7ubuntu1","2.29.1-8ubuntu1","2.29.1-10ubuntu1","2.29.1-12ubuntu1","2.30-4ubuntu1","2.30-5ubuntu1","2.30-7ubuntu1","2.30-8ubuntu1","2.30-9ubuntu1","2.30-10ubuntu1","2.30-11ubuntu1","2.30-14ubuntu2","2.30-15ubuntu1","2.30-20ubuntu2~18.04","2.30-21ubuntu1~18.04","2.30-21ubuntu1~18.04.1","2.30-21ubuntu1~18.04.2","2.30-21ubuntu1~18.04.3","2.30-21ubuntu1~18.04.4","2.30-21ubuntu1~18.04.5","2.30-21ubuntu1~18.04.7","2.30-21ubuntu1~18.04.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-6ubuntu1.5"}]}],"versions":["2.33-2ubuntu1","2.33.1-1ubuntu1","2.33.1-5ubuntu1","2.33.1-6ubuntu1","2.33.1-6ubuntu3","2.33.90.20200122-1ubuntu2","2.34-1ubuntu1","2.34-3ubuntu1","2.34-4ubuntu1","2.34-5ubuntu1","2.34-6ubuntu1","2.34-6ubuntu1.1","2.34-6ubuntu1.3","2.34-6ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-4ubuntu2.2"}]}],"versions":["2.37-7ubuntu1","2.37-9ubuntu1","2.37-10ubuntu1","2.37.50.20220106-2ubuntu1","2.37.90.20220126-0ubuntu1","2.37.90.20220130-0ubuntu2","2.38-1ubuntu1","2.38-2ubuntu1","2.38-3ubuntu1","2.38-4ubuntu2","2.38-4ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-5ubuntu14.2+esm1"}]}],"versions":["2.23.52.20130913-0ubuntu1","2.23.90.20131017-1ubuntu1","2.23.90.20131116-1ubuntu1","2.23.91.20131123-1ubuntu1","2.24-1ubuntu1","2.24-1ubuntu2","2.24-2ubuntu1","2.24-2ubuntu2","2.24-2ubuntu3","2.24-4ubuntu1","2.24-5ubuntu1","2.24-5ubuntu2","2.24-5ubuntu3","2.24-5ubuntu3.1","2.24-5ubuntu13","2.24-5ubuntu14","2.24-5ubuntu14.1","2.24-5ubuntu14.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm6"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8","2.26.1-1ubuntu1~16.04.8+esm1","2.26.1-1ubuntu1~16.04.8+esm3","2.26.1-1ubuntu1~16.04.8+esm4","2.26.1-1ubuntu1~16.04.8+esm5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30-21ubuntu1~18.04.9"}]}],"versions":["2.29.1-4ubuntu1","2.29.1-6ubuntu1","2.29.1-7ubuntu1","2.29.1-8ubuntu1","2.29.1-10ubuntu1","2.29.1-12ubuntu1","2.30-4ubuntu1","2.30-5ubuntu1","2.30-7ubuntu1","2.30-8ubuntu1","2.30-9ubuntu1","2.30-10ubuntu1","2.30-11ubuntu1","2.30-14ubuntu2","2.30-15ubuntu1","2.30-20ubuntu2~18.04","2.30-21ubuntu1~18.04","2.30-21ubuntu1~18.04.1","2.30-21ubuntu1~18.04.2","2.30-21ubuntu1~18.04.3","2.30-21ubuntu1~18.04.4","2.30-21ubuntu1~18.04.5","2.30-21ubuntu1~18.04.7","2.30-21ubuntu1~18.04.8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-6ubuntu1.5"}]}],"versions":["2.33-2ubuntu1","2.33.1-1ubuntu1","2.33.1-5ubuntu1","2.33.1-6ubuntu1","2.33.1-6ubuntu3","2.33.90.20200122-1ubuntu2","2.34-1ubuntu1","2.34-3ubuntu1","2.34-4ubuntu1","2.34-5ubuntu1","2.34-6ubuntu1","2.34-6ubuntu1.1","2.34-6ubuntu1.3","2.34-6ubuntu1.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-4ubuntu2.2"}]}],"versions":["2.37-7ubuntu1","2.37-9ubuntu1","2.37-10ubuntu1","2.37.50.20220106-2ubuntu1","2.37.90.20220126-0ubuntu1","2.37.90.20220130-0ubuntu2","2.38-1ubuntu1","2.38-2ubuntu1","2.38-3ubuntu1","2.38-4ubuntu2","2.38-4ubuntu2.1"],"bundled":4}],"products":[{"vendor":"fedora","product":"extra packages for enterprise linux 7"},{"vendor":"fedora","product":"extra packages for enterprise linux 8"},{"vendor":"fedora","product":"fedora"},{"vendor":"fedora","product":"fedora 36"},{"vendor":"fedora","product":"fedora 37"},{"vendor":"gnu","product":"binutils"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-25584","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167467","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Patch","report"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44","tags":["x_transferred","Mailing List","Patch","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20231103-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25584","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231103-0002"},{"url":"https://github.com/advisories/GHSA-xgv8-vx7r-x752"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-25584","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1687795384","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1761847256.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776430866.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1777059908.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://packages.fedoraproject.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25584.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25584","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-25584","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6101-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-1579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-1972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25588","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-25584","title":"Out of bounds read in parse_module function in bfd/vms-alpha.c","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T20:50:58.267Z","modified":"2025-02-13T16:44:31.939Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:19.959682Z"}],"euvd":[{"id":"EUVD-2023-29526","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T20:50:58Z","modified":"2025-02-13T16:44:31Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:51.372924Z"}],"ghsa":[{"id":"GHSA-xgv8-vx7r-x752","title":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T21:30:26Z","modified":"2024-03-03T05:06:59Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:55:38.39087Z"}],"nvd":[{"id":"CVE-2023-25584","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T21:15:10.023Z","modified":"2026-06-17T05:41:32.713Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"BELL-CVE-2023-25584","title":"CVE-2023-25584 does not affect BellSoft software","status":"withdrawn","published":"2023-09-14T21:15:00Z","modified":"2026-01-26T09:48:09.70178Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-25584","title":"Out of bounds read in parse_module function in bfd/vms-alpha.c","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T20:50:58.267Z","modified":"2026-10-28T02:30:45.588544418Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25584","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-09-14T21:15:10.023Z","modified":"2026-10-26T18:00:37.476645693Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-25584","description":"An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.","status":"published","published":"2023-02-15T00:00:00Z","modified":"2026-04-22T14:03:22.564002Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"CLSA-2023-1687795384","title":"Fix CVE(s): CVE-2023-25584, CVE-2017-12450, CVE-2023-25588, CVE-2023-25585","description":"\n   * SECURITY UPDATE: fixing the existing CVE-2017-12450 patches that were\n     incorrectly ported from upstream\n     - debian/patches/CVE-2017-12450-1.patch: fix address violation errors\n     - debian/patches/CVE-2017-12450-2.patch: import patches from mainline\n       to fix minor binutils bugs\n     - CVE-2017-12450\n   * SECURITY UPDATE: heap-based buffer overflow\n     - debian/patches/CVE-2023-25584.patch: lack of bounds checking in\n       vms-alpha.c\n     - CVE-2023-25584\n   * SECURITY UPDATE: segmentation fault due to uninitialized\n     - debian/patches/CVE-2023-25585.patch: field file_table of struct\n       module is uninitialized\n     - CVE-2023-25585\n   * SECURITY UPDATE: segmentation fault due to uninitialized\n     - debian/patches/CVE-2023-25588.patch: field `the_bfd` of `asymbol`\n       is uninitialised\n     - CVE-2023-25588\n   * Fix memory leaks and buffer overflow in vms-alpha.c\n     - debian/patches/vms-alpha-buffer-overflow-fix.patch: fix heap-based buffer\n       overflow in build_module_list in vms-alpha.c\n     - debian/patches/vms-alpha-memory-leaks-fix.patch: fix memory leaks and\n       buffer overflow in vms-alpha.c","status":"published","published":"2023-06-26T16:03:09Z","modified":"2026-06-04T10:03:45.874530763Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2025-1761847256","title":"Fix CVE(s): CVE-2022-47673, CVE-2023-25584","description":"   * SECURITY UPDATE: multiple vulnerabilities in vms-alpha.c parse_module\n     - debian/patches/CVE-2022-47673_CVE-2023-25584-*.patch: fix null pointer\n       dereference in parse_module by adding return value checking for\n       bfd_zalloc calls, fix potential out of bounds memory access\n       in DST record parsing loop\n     - CVE-2022-47673, CVE-2023-25584","status":"published","published":"2025-10-30T18:00:59Z","modified":"2026-06-04T10:03:44.446867Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1776430866","title":"binutils: Fix of 5 CVEs","description":"- CVE-2022-44840: fix heap buffer overflow in find_section_in_set in dwarf.c\n- CVE-2023-25584: fix lack of bounds checking in vms-alpha.c parse_module\n- CVE-2022-47673: fix OOB reads in parse_module\n- CVE-2022-47696: fix uninitialised the_bfd field in mach-o.c synthetic symbols\n- CVE-2022-45703: fix heap buffer overflow in display_gdb_index in dwarf.c","status":"published","published":"2026-04-17T17:28:13Z","modified":"2026-10-21T10:46:25.59555809Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777059908","title":"binutils: Fix of 4 CVEs","description":"- CVE-2022-47673: fix out-of-bounds reads in parse_module (bfd/vms-alpha.c),\n  combined backport of upstream commits c9178f28, 942fa4fb, 77c225bd, 65cf035b\n  and c093f5ee (patch also covers CVE-2023-25584)\n- CVE-2022-47695: fix segfault in objdump compare_symbols on synthetic plt symbols\n- CVE-2022-47696: fix out-of-bounds read in bfd/mach-o.c\n  bfd_mach_o_get_synthetic_symtab","status":"published","published":"2026-04-24T20:29:12Z","modified":"2026-10-21T10:47:31.603577672Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"USN-6101-1","title":"binutils vulnerabilities","description":"It was discovered that GNU binutils incorrectly handled certain DWARF\nfiles. An attacker could possibly use this issue to cause a crash or\nexecute arbitrary code. This issue only affected Ubuntu 22.10.\n(CVE-2023-1579)\n\nIt was discovered that GNU binutils did not properly verify the version\ndefinitions in zer0-lengthverdef table. An attacker could possibly use this\nissue to cause a crash or execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-1972)\n\nIt was discovered that GNU binutils did not properly validate the size of\nlength parameter in vms-alpha. An attacker could possibly use this issue to\ncause a crash or access sensitive information. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10.\n(CVE-2023-25584)\n\nIt was discovered that GNU binutils did not properly initialized the\nfile_table field of struct module and the_bfd field of asymbol. An attacker\ncould possibly use this issue to cause a crash. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-25585, CVE-2023-25588)\n","status":"published","published":"2023-05-24T08:57:00Z","modified":"2026-06-29T13:50:52.316159892Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}