CVE-2020-35495: Null Pointer Dereference
GNU Binutils before 2.34 has a NULL pointer deference vulnerability in function bfdpefparsesymbols (file bfd/pef.c) which could allow attackers to cause a denial of service.
Reference: https://sourceware.org/bugzilla/showbug.cgi?id=25306
Other sources
GNU Binutils is vulnerable to a denial of service, caused by NULL pointer dereference in the bfdpefparsesymbols function in bfd/pef.c in the Binary File Descriptor (BFD) library. By persuading a victim to open a specially-crafted file with corrupt dwarf1 debug information, a remote attacker could cause a denial of service.
— IBM
There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-35495?
CVE-2020-35495 is a vulnerability in binutils /bfd/pef.c that allows an attacker to cause a null pointer dereference by submitting a crafted input file to the objdump program.
What is the greatest threat from CVE-2020-35495?
The greatest threat from CVE-2020-35495 is to application availability.
Which software versions are affected by CVE-2020-35495?
CVE-2020-35495 affects binutils versions prior to 2.34.
How can I fix CVE-2020-35495?
To fix CVE-2020-35495, you should upgrade to binutils version 2.34 or higher.
Where can I find more information about CVE-2020-35495?
You can find more information about CVE-2020-35495 at the following references: [1](https://sourceware.org/bugzilla/show_bug.cgi?id=25306), [2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1911442), [3](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7a0fb7be96e0ce79e1ae429bc1ba913e5244d537).