Buffer overflow in Binutils - CVE-2014-8501

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32469

Buffer overflow in Binutils - CVE-2014-8501

Published: December 10, 2014 / Updated: July 28, 2020


Vulnerability identifier: #VU32469
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-8501
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.


Affected software

Binutils
Amazon Linux AMI
Gentoo Linux
Fedora
binutils (Alpine package)
avr-binutils
mingw-binutils
cross-binutils
cross-gcc
arm-none-eabi-binutils-cs

How to mitigate CVE-2014-8501

Install update from vendor's website.

binutils (Alpine package) - update to 2.24-r3
avr-binutils - update to 2.24-4.fc21
mingw-binutils - addressed in versions 2.25-1.el7, 2.25-1.fc21
cross-binutils - update to 2.27-9.el7.1
cross-gcc - update to 4.8.5-16.el7.1
arm-none-eabi-binutils-cs - update to 2014.05.28-3.fc21

External References

Related Security Bulletins