CVE-2019-12972: Medium severity binutils vulnerability
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in bfddoprnt in bfd.c because elfobjectp in elfcode.h mishandles an eshstrndx section of type SHTGROUP by omitting a trailing '\0' character.
Other sources
GNU binutils is vulnerable to a denial of service, caused by a heap-based buffer over-read in the bfddoprnt in bfd.c of libbfd. By using a specially-crafted file, a local attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-12972.
What is the affected software?
The affected software is GNU Binutils version 2.32.
What is the severity of CVE-2019-12972?
The severity of CVE-2019-12972 is not specified.
How does CVE-2019-12972 occur?
CVE-2019-12972 occurs due to a heap-based buffer over-read in the Binary File Descriptor (BFD) library.
Is there a fix available for CVE-2019-12972?
Yes, a fix is available for CVE-2019-12972. Users should update to version 2.32.51.20190707-1 of the Ubuntu binutils package.