Sign-up

ID

VAR-202101-0565


CVE

CVE-2020-35494


TITLE

binutils  Vulnerability in using uninitialized resources in

Trust: 0.8

sources: JVNDB: JVNDB-2020-015128

DESCRIPTION

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34. binutils There is a vulnerability in the use of uninitialized resources.Information is obtained and denial of service (DoS) It may be put into a state. GNU Binutils (GNU Binary Utilities or binutils) is a set of programming language tool programs developed by the GNU community. The program is primarily designed to handle object files in various formats and provides linkers, assemblers, and other tools for object files and archives. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Binutils: Multiple vulnerabilities Date: July 10, 2021 Bugs: #678806, #761957, #764170 ID: 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Binutils, the worst of which could result in a Denial of Service condition. Background ========== The GNU Binutils are a collection of tools to create, modify and analyse binary files. Many of the files use BFD, the Binary File Descriptor library, to do low-level manipulation. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-devel/binutils < 2.35.2 >= 2.35.2 Description =========== Multiple vulnerabilities have been discovered in Binutils. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Binutils users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.35.2" References ========== [ 1 ] CVE-2019-9070 https://nvd.nist.gov/vuln/detail/CVE-2019-9070 [ 2 ] CVE-2019-9071 https://nvd.nist.gov/vuln/detail/CVE-2019-9071 [ 3 ] CVE-2019-9072 https://nvd.nist.gov/vuln/detail/CVE-2019-9072 [ 4 ] CVE-2019-9073 https://nvd.nist.gov/vuln/detail/CVE-2019-9073 [ 5 ] CVE-2019-9074 https://nvd.nist.gov/vuln/detail/CVE-2019-9074 [ 6 ] CVE-2019-9075 https://nvd.nist.gov/vuln/detail/CVE-2019-9075 [ 7 ] CVE-2019-9076 https://nvd.nist.gov/vuln/detail/CVE-2019-9076 [ 8 ] CVE-2019-9077 https://nvd.nist.gov/vuln/detail/CVE-2019-9077 [ 9 ] CVE-2020-19599 https://nvd.nist.gov/vuln/detail/CVE-2020-19599 [ 10 ] CVE-2020-35448 https://nvd.nist.gov/vuln/detail/CVE-2020-35448 [ 11 ] CVE-2020-35493 https://nvd.nist.gov/vuln/detail/CVE-2020-35493 [ 12 ] CVE-2020-35494 https://nvd.nist.gov/vuln/detail/CVE-2020-35494 [ 13 ] CVE-2020-35495 https://nvd.nist.gov/vuln/detail/CVE-2020-35495 [ 14 ] CVE-2020-35496 https://nvd.nist.gov/vuln/detail/CVE-2020-35496 [ 15 ] CVE-2020-35507 https://nvd.nist.gov/vuln/detail/CVE-2020-35507 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202107-24 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.89

sources: NVD: CVE-2020-35494 // JVNDB: JVNDB-2020-015128 // VULHUB: VHN-377690 // VULMON: CVE-2020-35494 // PACKETSTORM: 163455

AFFECTED PRODUCTS

vendor:netappmodel:solidfire \& hci management nodescope:eqversion: -

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:32

Trust: 1.0

vendor:netappmodel:ontap select deploy administration utilityscope:eqversion: -

Trust: 1.0

vendor:netappmodel:hci compute nodescope:eqversion: -

Trust: 1.0

vendor:netappmodel:solidfire\, enterprise sds \& hci storage nodescope:eqversion: -

Trust: 1.0

vendor:gnumodel:binutilsscope:ltversion:2.34

Trust: 1.0

vendor:netappmodel:cloud backupscope:eqversion: -

Trust: 1.0

vendor:broadcommodel:brocade fabric operating systemscope:eqversion: -

Trust: 1.0

vendor:netappmodel:ontap select deploy utilityscope: - version: -

Trust: 0.8

vendor:netappmodel:solidfirescope: - version: -

Trust: 0.8

vendor:netappmodel:hci management nodescope: - version: -

Trust: 0.8

vendor:gnumodel:binutilsscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope: - version: -

Trust: 0.8

vendor:netappmodel:hci compute nodescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-015128 // NVD: CVE-2020-35494

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-35494
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-35494
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202101-080
value: MEDIUM

Trust: 0.6

VULHUB: VHN-377690
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-35494
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-35494
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-377690
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-35494
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2020-35494
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-377690 // VULMON: CVE-2020-35494 // JVNDB: JVNDB-2020-015128 // CNNVD: CNNVD-202101-080 // NVD: CVE-2020-35494

PROBLEMTYPE DATA

problemtype:CWE-908

Trust: 1.1

problemtype:Use of uninitialized resources (CWE-908) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-377690 // JVNDB: JVNDB-2020-015128 // NVD: CVE-2020-35494

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202101-080

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202101-080

PATCH

title:NTAP-20210212-0007url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/

Trust: 0.8

title:GNU Binutils Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138341

Trust: 0.6

title: - url:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2020-35494 // JVNDB: JVNDB-2020-015128 // CNNVD: CNNVD-202101-080

EXTERNAL IDS

db:NVDid:CVE-2020-35494

Trust: 2.7

db:PACKETSTORMid:163455

Trust: 0.8

db:JVNDBid:JVNDB-2020-015128

Trust: 0.8

db:CNNVDid:CNNVD-202101-080

Trust: 0.7

db:VULHUBid:VHN-377690

Trust: 0.1

db:VULMONid:CVE-2020-35494

Trust: 0.1

sources: VULHUB: VHN-377690 // VULMON: CVE-2020-35494 // JVNDB: JVNDB-2020-015128 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-080 // NVD: CVE-2020-35494

REFERENCES

url:https://bugzilla.redhat.com/show_bug.cgi?id=1911439

Trust: 2.6

url:https://security.gentoo.org/glsa/202107-24

Trust: 1.9

url:https://security.netapp.com/advisory/ntap-20210212-0007/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-35494

Trust: 1.5

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 0.8

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics/

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics-for-nps/

Trust: 0.6

url:https://packetstormsecurity.com/files/163455/gentoo-linux-security-advisory-202107-24.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/binutils-information-disclosure-via-tic4x-print-cond-34253

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-performance-server/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/908.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2020-35494

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35495

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-19599

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9071

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9077

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35493

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9073

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9072

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35448

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9074

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35507

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9070

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35496

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9076

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9075

Trust: 0.1

sources: VULHUB: VHN-377690 // VULMON: CVE-2020-35494 // JVNDB: JVNDB-2020-015128 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-080 // NVD: CVE-2020-35494

CREDITS

Gentoo

Trust: 0.1

sources: PACKETSTORM: 163455

SOURCES

db:VULHUBid:VHN-377690
db:VULMONid:CVE-2020-35494
db:JVNDBid:JVNDB-2020-015128
db:PACKETSTORMid:163455
db:CNNVDid:CNNVD-202101-080
db:NVDid:CVE-2020-35494

LAST UPDATE DATE

2024-08-14T12:27:04.554000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-377690date:2022-09-02T00:00:00
db:VULMONid:CVE-2020-35494date:2022-09-02T00:00:00
db:JVNDBid:JVNDB-2020-015128date:2021-09-10T07:59:00
db:CNNVDid:CNNVD-202101-080date:2022-09-05T00:00:00
db:NVDid:CVE-2020-35494date:2023-11-07T03:21:55.540

SOURCES RELEASE DATE

db:VULHUBid:VHN-377690date:2021-01-04T00:00:00
db:VULMONid:CVE-2020-35494date:2021-01-04T00:00:00
db:JVNDBid:JVNDB-2020-015128date:2021-09-10T00:00:00
db:PACKETSTORMid:163455date:2021-07-11T12:01:11
db:CNNVDid:CNNVD-202101-080date:2021-01-04T00:00:00
db:NVDid:CVE-2020-35494date:2021-01-04T15:15:13.200