CVE-2020-35448

Name
CVE-2020-35448
Description
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.
NVD Severity
low
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8642dafaef21aa6747cec01df1977e9c52eb4679
Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=26574
Third Party Advisory https://security.netapp.com/advisory/ntap-20210129-0008/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnu:binutils:2.35.1:*:*:*:*:*:*:* binutils == None == 2.35.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
binutils-cross-embedded edge-community 2.37-r0 Marian Buschsieweke <marian.buschsieweke@ovgu.de> fixed