Buffer overflow in Binutils - CVE-2014-8738

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32474

Buffer overflow in Binutils - CVE-2014-8738

Published: January 15, 2015 / Updated: July 28, 2020


Vulnerability identifier: #VU32474
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-8738
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.


Affected software

Binutils
Amazon Linux AMI
Gentoo Linux
Fedora
binutils (Alpine package)
cross-binutils
avr-binutils
binutils
arm-none-eabi-binutils-cs

How to mitigate CVE-2014-8738

Install update from vendor's website.

binutils (Alpine package) - update to 2.24-r3
cross-binutils - addressed in versions 2.23.51.0.3-1.el6.1, 2.23.88.0.1-2.el7.1
avr-binutils - update to 2.24-4.fc21
binutils - update to 2.24-30.fc21
arm-none-eabi-binutils-cs - update to 2014.05.28-3.fc21

External References

Related Security Bulletins