CVE-2020-35448

 

Published at: - 27-12-2020 05:15

Last modified: - 26-04-2022 06:13

Total changes: - 7

Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8642dafaef21aa6747cec01df1977e9c52eb4679
• https://sourceware.org/bugzilla/show_bug.cgi?id=26574
• https://security.netapp.com/advisory/ntap-20210129-0008/
• GLSA-202107-24-Third Party Advisory

 

Keywords

NVD

 

CVE-2020-35448

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures