Sign-up

ID

VAR-202101-0566


CVE

CVE-2020-35495


TITLE

binutils  In  NULL  Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-015127

DESCRIPTION

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34. binutils Has NULL A pointer dereference vulnerability exists.Denial of service (DoS) It may be put into a state. GNU Binutils (GNU Binary Utilities or binutils) is a set of programming language tool programs developed by the GNU community. The program is primarily designed to handle object files in various formats and provides linkers, assemblers, and other tools for object files and archives. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Binutils: Multiple vulnerabilities Date: July 10, 2021 Bugs: #678806, #761957, #764170 ID: 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Binutils, the worst of which could result in a Denial of Service condition. Background ========== The GNU Binutils are a collection of tools to create, modify and analyse binary files. Many of the files use BFD, the Binary File Descriptor library, to do low-level manipulation. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-devel/binutils < 2.35.2 >= 2.35.2 Description =========== Multiple vulnerabilities have been discovered in Binutils. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Binutils users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.35.2" References ========== [ 1 ] CVE-2019-9070 https://nvd.nist.gov/vuln/detail/CVE-2019-9070 [ 2 ] CVE-2019-9071 https://nvd.nist.gov/vuln/detail/CVE-2019-9071 [ 3 ] CVE-2019-9072 https://nvd.nist.gov/vuln/detail/CVE-2019-9072 [ 4 ] CVE-2019-9073 https://nvd.nist.gov/vuln/detail/CVE-2019-9073 [ 5 ] CVE-2019-9074 https://nvd.nist.gov/vuln/detail/CVE-2019-9074 [ 6 ] CVE-2019-9075 https://nvd.nist.gov/vuln/detail/CVE-2019-9075 [ 7 ] CVE-2019-9076 https://nvd.nist.gov/vuln/detail/CVE-2019-9076 [ 8 ] CVE-2019-9077 https://nvd.nist.gov/vuln/detail/CVE-2019-9077 [ 9 ] CVE-2020-19599 https://nvd.nist.gov/vuln/detail/CVE-2020-19599 [ 10 ] CVE-2020-35448 https://nvd.nist.gov/vuln/detail/CVE-2020-35448 [ 11 ] CVE-2020-35493 https://nvd.nist.gov/vuln/detail/CVE-2020-35493 [ 12 ] CVE-2020-35494 https://nvd.nist.gov/vuln/detail/CVE-2020-35494 [ 13 ] CVE-2020-35495 https://nvd.nist.gov/vuln/detail/CVE-2020-35495 [ 14 ] CVE-2020-35496 https://nvd.nist.gov/vuln/detail/CVE-2020-35496 [ 15 ] CVE-2020-35507 https://nvd.nist.gov/vuln/detail/CVE-2020-35507 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202107-24 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.89

sources: NVD: CVE-2020-35495 // JVNDB: JVNDB-2020-015127 // VULHUB: VHN-377691 // VULMON: CVE-2020-35495 // PACKETSTORM: 163455

AFFECTED PRODUCTS

vendor:netappmodel:solidfire \& hci management nodescope:eqversion: -

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:32

Trust: 1.0

vendor:netappmodel:ontap select deploy administration utilityscope:eqversion: -

Trust: 1.0

vendor:netappmodel:hci compute nodescope:eqversion: -

Trust: 1.0

vendor:netappmodel:solidfire\, enterprise sds \& hci storage nodescope:eqversion: -

Trust: 1.0

vendor:gnumodel:binutilsscope:ltversion:2.34

Trust: 1.0

vendor:netappmodel:cloud backupscope:eqversion: -

Trust: 1.0

vendor:broadcommodel:brocade fabric operating systemscope:eqversion: -

Trust: 1.0

vendor:netappmodel:ontap select deploy utilityscope: - version: -

Trust: 0.8

vendor:netappmodel:solidfirescope: - version: -

Trust: 0.8

vendor:netappmodel:hci management nodescope: - version: -

Trust: 0.8

vendor:gnumodel:binutilsscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope: - version: -

Trust: 0.8

vendor:netappmodel:hci compute nodescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-015127 // NVD: CVE-2020-35495

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-35495
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-35495
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202101-085
value: MEDIUM

Trust: 0.6

VULHUB: VHN-377691
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-35495
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-35495
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-377691
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-35495
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-35495
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-377691 // VULMON: CVE-2020-35495 // JVNDB: JVNDB-2020-015127 // CNNVD: CNNVD-202101-085 // NVD: CVE-2020-35495

PROBLEMTYPE DATA

problemtype:CWE-476

Trust: 1.1

problemtype:NULL Pointer dereference (CWE-476) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-377691 // JVNDB: JVNDB-2020-015127 // NVD: CVE-2020-35495

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202101-085

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202101-085

PATCH

title:Bug 25306 NetAppNetApp Advisoryurl:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/

Trust: 0.8

title:GNU binutils Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138344

Trust: 0.6

title: - url:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2020-35495 // JVNDB: JVNDB-2020-015127 // CNNVD: CNNVD-202101-085

EXTERNAL IDS

db:NVDid:CVE-2020-35495

Trust: 2.7

db:PACKETSTORMid:163455

Trust: 0.8

db:JVNDBid:JVNDB-2020-015127

Trust: 0.8

db:CNNVDid:CNNVD-202101-085

Trust: 0.7

db:VULHUBid:VHN-377691

Trust: 0.1

db:VULMONid:CVE-2020-35495

Trust: 0.1

sources: VULHUB: VHN-377691 // VULMON: CVE-2020-35495 // JVNDB: JVNDB-2020-015127 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-085 // NVD: CVE-2020-35495

REFERENCES

url:https://bugzilla.redhat.com/show_bug.cgi?id=1911441

Trust: 2.6

url:https://security.gentoo.org/glsa/202107-24

Trust: 1.9

url:https://security.netapp.com/advisory/ntap-20210212-0007/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-35495

Trust: 1.5

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 0.8

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics/

Trust: 0.6

url:https://vigilance.fr/vulnerability/binutils-null-pointer-dereference-via-bfd-pef-parse-symbols-34254

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics-for-nps/

Trust: 0.6

url:https://packetstormsecurity.com/files/163455/gentoo-linux-security-advisory-202107-24.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-performance-server/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/476.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2020-35495

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-19599

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9071

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9077

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35493

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9073

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9072

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35448

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9074

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35507

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9070

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35496

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9076

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9075

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35494

Trust: 0.1

sources: VULHUB: VHN-377691 // VULMON: CVE-2020-35495 // JVNDB: JVNDB-2020-015127 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-085 // NVD: CVE-2020-35495

CREDITS

Gentoo

Trust: 0.1

sources: PACKETSTORM: 163455

SOURCES

db:VULHUBid:VHN-377691
db:VULMONid:CVE-2020-35495
db:JVNDBid:JVNDB-2020-015127
db:PACKETSTORMid:163455
db:CNNVDid:CNNVD-202101-085
db:NVDid:CVE-2020-35495

LAST UPDATE DATE

2024-08-14T12:53:43.035000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-377691date:2022-09-02T00:00:00
db:VULMONid:CVE-2020-35495date:2022-09-02T00:00:00
db:JVNDBid:JVNDB-2020-015127date:2021-09-10T07:56:00
db:CNNVDid:CNNVD-202101-085date:2022-09-05T00:00:00
db:NVDid:CVE-2020-35495date:2023-11-07T03:21:55.620

SOURCES RELEASE DATE

db:VULHUBid:VHN-377691date:2021-01-04T00:00:00
db:VULMONid:CVE-2020-35495date:2021-01-04T00:00:00
db:JVNDBid:JVNDB-2020-015127date:2021-09-10T00:00:00
db:PACKETSTORMid:163455date:2021-07-11T12:01:11
db:CNNVDid:CNNVD-202101-085date:2021-01-04T00:00:00
db:NVDid:CVE-2020-35495date:2021-01-04T15:15:13.667