Description
An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | binutils | GNU binutils version 2.36 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | binutils | 2.37-3 | — |
| Debian 13 | binutils | 2.37-3 | — |
| Debian 12 | binutils | 2.37-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | binutils | 2.37-7ubuntu1 | — |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1960717
- GLSA-202208-30 vendor-advisory