From fe7dd061da89ba7386e7e081c19c1f14cad72698 Mon Sep 17 00:00:00 2001 From: Yasuhiro Kimura Date: Tue, 25 May 2021 04:59:27 +0900 Subject: [PATCH] security/vuxml: Document excessive memory consumption vulnerability in binutils Document excessive memory consumption vulnerability in binutils. --- security/vuxml/vuln.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f59756dc1458..2b23dbb8f1e1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section() + + + binutils + 2.33.1_5 + + + + +

Hao Wang reports:

+
+ There's a flaw in the BFD library of binutils in versions before 2.36. + An attacker who supplies a crafted file to an application linked with BFD, + and using the DWARF functionality, could cause an impact to system + availability by way of excessive memory consumption. +
+

+ + + + CVE-2021-3487 + https://sourceware.org/bugzilla/show_bug.cgi?id=26946 + + + 2020-11-25 + 2021-05-24 + + + isc-dhcp -- remotely exploitable vulnerability -- 2.31.1