Vulnerability Description
binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Binutils | < 2.32 |
| Canonical | Ubuntu Linux | 18.04 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.htmlBroken Link
- http://www.securityfocus.com/bid/106304Broken Link
- https://access.redhat.com/errata/RHSA-2019:2075Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=23994ExploitIssue TrackingThird Party Advisory
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=3a551c7a1b80fca5794
- https://usn.ubuntu.com/4336-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.htmlBroken Link
- http://www.securityfocus.com/bid/106304Broken Link
- https://access.redhat.com/errata/RHSA-2019:2075Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=23994ExploitIssue TrackingThird Party Advisory
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=3a551c7a1b80fca5794
- https://usn.ubuntu.com/4336-1/Third Party Advisory
FAQ
What is CVE-2018-1000876?
CVE-2018-1000876 is a vulnerability with a CVSS score of 7.8 (HIGH). binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger hea...
How severe is CVE-2018-1000876?
CVE-2018-1000876 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000876?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Binutils, Canonical Ubuntu Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.