Description
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | binutils | No fix yet | — |
| Ubuntu Pro 16.04 LTS | binutils | No fix yet | — |
| Ubuntu Pro 14.04 LTS | binutils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | gdb +3 | 8.2-6.el8 | RHSA-2019:3352 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | gdb +3 | 8.2-6.el8 | ELSA-2019-3352 |
Advisories 3
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:3352 Red Hat Security Advisory: gdb security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Mar 19, 2026
- ELSA-2019-3352 Low: gdb security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
References
- 106444 vdb-entry
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539
- https://support.f5.com/csp/article/K62602089
- RHSA-2019:3352 vendor-advisory