CVE-2020-35493: Input Validation
A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.
Other sources
GNU Binutils is vulnerable a heap-based buffer overflow, caused by improper bounds checking in bfdpefparsefunctionstubs in bfd/pef.c. By persuading a victim to open a specially crafted file, a remote attacker could overflow a buffer to cause an out-of-bounds read, leading to a denial of service.
— IBM
Objdump of GNU Binutils before 2.34 has a heap-buffer-overflow in function bfdpefparsefunctionstubs (file bfd/pef.c) which could allow attackers to cause a denial of service or unspecified impact.
Reference: https://sourceware.org/bugzilla/showbug.cgi?id=25307
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-35493?
CVE-2020-35493 is a vulnerability in binutils in bfd/pef.c that could cause a heap buffer overflow and out-of-bounds read.
How does CVE-2020-35493 affect application availability?
CVE-2020-35493 could lead to an impact on application availability.
Which versions of binutils are affected by CVE-2020-35493?
CVE-2020-35493 affects binutils versions prior to 2.34.
How can I fix CVE-2020-35493?
To fix CVE-2020-35493, update binutils to version 2.34 or later.
Where can I find more information about CVE-2020-35493?
You can find more information about CVE-2020-35493 at the following references: - [Bugzilla Bug Report](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1911438) - [Sourceware Bug Report](https://sourceware.org/bugzilla/show_bug.cgi?id=25307) - [Binutils Git Commit](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f2a3559d54602cecfec6d90f792be4a70ad918ab)