Description
An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | binutils | 2.30-21ubuntu1~18.04.3 | USN-4336-1 |
| Ubuntu 18.04 LTS | libiberty | 20170913-1ubuntu0.1 | USN-4326-1 |
| Ubuntu 16.04 LTS | libiberty | 20160215-1ubuntu0.3 | USN-4326-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | binutils | 2.26.1-1ubuntu1~16.04.8+esm1 | USN-4336-2 |
| Ubuntu Pro 14.04 LTS | binutils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | binutils +1 | 2.27-41.base.el7 | RHSA-2019:2075 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | binutils +1 | 2.29.1-29.amzn2 | ALAS2-2019-1358 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | binutils +1 | 2.27-41.base.0.2.el7 | ELSA-2019-2075 |
Advisories 7
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:2075 Red Hat Security Advisory: binutils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-4336-2 binutils vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-4336-1 binutils vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4326-1 libiberty vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- ALAS2-2019-1358 Moderate: binutils security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 14, 2019
- ELSA-2019-2075 Moderate: binutils security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
References
- https://sourceware.org/bugzilla/show_bug.cgi?id=23058
- https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763099
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85452
- GLSA-201908-01 vendor-advisory
- RHSA-2019:2075 vendor-advisory
- USN-4326-1 vendor-advisory
- USN-4336-1 vendor-advisory