Memory leak in Binutils - CVE-2020-21490

Vulnerability identifier: #VU88552

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-21490

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak. A local user can force the application to leak memory and perform denial of service attack.

Binutils
Ubuntu
binutils (Ubuntu package)
binutils-multiarch (Ubuntu package)
IBM Sterling Order Management

Install updates from vendor's website.

Binutils - update to 2.34
binutils (Ubuntu package) - update to Ubuntu Pro (Infra-only)
binutils-multiarch (Ubuntu package) - update to Ubuntu Pro (Infra-only)
IBM Sterling Order Management - update to 10.0.2403.1

• https://sourceware.org/bugzilla/show_bug.cgi?id=25249
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=378fd436405b3051df34ac995b2e03fe1f3d1907
• https://security.netapp.com/advisory/ntap-20230929-0007/

• Multiple vulnerabilities in IBM Sterling Order Management
• Ubuntu update for binutils