Sign-up

ID

VAR-202101-0567


CVE

CVE-2020-35496


TITLE

binutils  In  NULL  Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-015126

DESCRIPTION

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. binutils Has NULL A pointer dereference vulnerability exists.Denial of service (DoS) It may be put into a state. GNU Binutils (GNU Binary Utilities or binutils) is a set of programming language tool programs developed by the GNU community. The program is primarily designed to handle object files in various formats and provides linkers, assemblers, and other tools for object files and archives. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Binutils: Multiple vulnerabilities Date: July 10, 2021 Bugs: #678806, #761957, #764170 ID: 202107-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Binutils, the worst of which could result in a Denial of Service condition. Background ========== The GNU Binutils are a collection of tools to create, modify and analyse binary files. Many of the files use BFD, the Binary File Descriptor library, to do low-level manipulation. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-devel/binutils < 2.35.2 >= 2.35.2 Description =========== Multiple vulnerabilities have been discovered in Binutils. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Binutils users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.35.2" References ========== [ 1 ] CVE-2019-9070 https://nvd.nist.gov/vuln/detail/CVE-2019-9070 [ 2 ] CVE-2019-9071 https://nvd.nist.gov/vuln/detail/CVE-2019-9071 [ 3 ] CVE-2019-9072 https://nvd.nist.gov/vuln/detail/CVE-2019-9072 [ 4 ] CVE-2019-9073 https://nvd.nist.gov/vuln/detail/CVE-2019-9073 [ 5 ] CVE-2019-9074 https://nvd.nist.gov/vuln/detail/CVE-2019-9074 [ 6 ] CVE-2019-9075 https://nvd.nist.gov/vuln/detail/CVE-2019-9075 [ 7 ] CVE-2019-9076 https://nvd.nist.gov/vuln/detail/CVE-2019-9076 [ 8 ] CVE-2019-9077 https://nvd.nist.gov/vuln/detail/CVE-2019-9077 [ 9 ] CVE-2020-19599 https://nvd.nist.gov/vuln/detail/CVE-2020-19599 [ 10 ] CVE-2020-35448 https://nvd.nist.gov/vuln/detail/CVE-2020-35448 [ 11 ] CVE-2020-35493 https://nvd.nist.gov/vuln/detail/CVE-2020-35493 [ 12 ] CVE-2020-35494 https://nvd.nist.gov/vuln/detail/CVE-2020-35494 [ 13 ] CVE-2020-35495 https://nvd.nist.gov/vuln/detail/CVE-2020-35495 [ 14 ] CVE-2020-35496 https://nvd.nist.gov/vuln/detail/CVE-2020-35496 [ 15 ] CVE-2020-35507 https://nvd.nist.gov/vuln/detail/CVE-2020-35507 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202107-24 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.89

sources: NVD: CVE-2020-35496 // JVNDB: JVNDB-2020-015126 // VULHUB: VHN-377692 // VULMON: CVE-2020-35496 // PACKETSTORM: 163455

AFFECTED PRODUCTS

vendor:netappmodel:solidfire \& hci management nodescope:eqversion: -

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:32

Trust: 1.0

vendor:netappmodel:ontap select deploy administration utilityscope:eqversion: -

Trust: 1.0

vendor:netappmodel:hci compute nodescope:eqversion: -

Trust: 1.0

vendor:netappmodel:solidfire\, enterprise sds \& hci storage nodescope:eqversion: -

Trust: 1.0

vendor:gnumodel:binutilsscope:ltversion:2.34

Trust: 1.0

vendor:netappmodel:cloud backupscope:eqversion: -

Trust: 1.0

vendor:broadcommodel:brocade fabric operating systemscope:eqversion: -

Trust: 1.0

vendor:netappmodel:ontap select deploy utilityscope: - version: -

Trust: 0.8

vendor:netappmodel:solidfirescope: - version: -

Trust: 0.8

vendor:netappmodel:hci management nodescope: - version: -

Trust: 0.8

vendor:gnumodel:binutilsscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope: - version: -

Trust: 0.8

vendor:netappmodel:hci compute nodescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-015126 // NVD: CVE-2020-35496

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-35496
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-35496
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202101-054
value: MEDIUM

Trust: 0.6

VULHUB: VHN-377692
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-35496
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-35496
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-377692
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-35496
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-35496
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-377692 // VULMON: CVE-2020-35496 // JVNDB: JVNDB-2020-015126 // CNNVD: CNNVD-202101-054 // NVD: CVE-2020-35496

PROBLEMTYPE DATA

problemtype:CWE-476

Trust: 1.1

problemtype:NULL Pointer dereference (CWE-476) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-377692 // JVNDB: JVNDB-2020-015126 // NVD: CVE-2020-35496

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202101-054

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202101-054

PATCH

title:Bug 25308 NetAppNetApp Advisoryurl:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/

Trust: 0.8

title:GNU Binutils Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138318

Trust: 0.6

title: - url:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2020-35496 // JVNDB: JVNDB-2020-015126 // CNNVD: CNNVD-202101-054

EXTERNAL IDS

db:NVDid:CVE-2020-35496

Trust: 2.7

db:PACKETSTORMid:163455

Trust: 0.8

db:JVNDBid:JVNDB-2020-015126

Trust: 0.8

db:AUSCERTid:ESB-2021.3660

Trust: 0.6

db:CNNVDid:CNNVD-202101-054

Trust: 0.6

db:VULHUBid:VHN-377692

Trust: 0.1

db:VULMONid:CVE-2020-35496

Trust: 0.1

sources: VULHUB: VHN-377692 // VULMON: CVE-2020-35496 // JVNDB: JVNDB-2020-015126 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-054 // NVD: CVE-2020-35496

REFERENCES

url:https://bugzilla.redhat.com/show_bug.cgi?id=1911444

Trust: 2.6

url:https://security.gentoo.org/glsa/202107-24

Trust: 1.9

url:https://security.netapp.com/advisory/ntap-20210212-0007/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-35496

Trust: 1.5

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4kok3qwsvoujwj54hvgifwnlwq5zy4s6/

Trust: 0.8

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3660

Trust: 0.6

url:https://vigilance.fr/vulnerability/binutils-null-pointer-dereference-via-bfd-pef-scan-start-address-34255

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-analytics-for-nps/

Trust: 0.6

url:https://packetstormsecurity.com/files/163455/gentoo-linux-security-advisory-202107-24.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-gnu-binutils-affect-ibm-netezza-performance-server/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/476.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2020-35496

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35495

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-19599

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9071

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9077

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35493

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9073

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9072

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35448

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9074

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35507

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9070

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9076

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-9075

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35494

Trust: 0.1

sources: VULHUB: VHN-377692 // VULMON: CVE-2020-35496 // JVNDB: JVNDB-2020-015126 // PACKETSTORM: 163455 // CNNVD: CNNVD-202101-054 // NVD: CVE-2020-35496

CREDITS

Gentoo

Trust: 0.1

sources: PACKETSTORM: 163455

SOURCES

db:VULHUBid:VHN-377692
db:VULMONid:CVE-2020-35496
db:JVNDBid:JVNDB-2020-015126
db:PACKETSTORMid:163455
db:CNNVDid:CNNVD-202101-054
db:NVDid:CVE-2020-35496

LAST UPDATE DATE

2024-08-14T12:49:02.075000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-377692date:2022-09-02T00:00:00
db:VULMONid:CVE-2020-35496date:2022-09-02T00:00:00
db:JVNDBid:JVNDB-2020-015126date:2021-09-10T07:10:00
db:CNNVDid:CNNVD-202101-054date:2022-09-05T00:00:00
db:NVDid:CVE-2020-35496date:2023-11-07T03:21:55.700

SOURCES RELEASE DATE

db:VULHUBid:VHN-377692date:2021-01-04T00:00:00
db:VULMONid:CVE-2020-35496date:2021-01-04T00:00:00
db:JVNDBid:JVNDB-2020-015126date:2021-09-10T00:00:00
db:PACKETSTORMid:163455date:2021-07-11T12:01:11
db:CNNVDid:CNNVD-202101-054date:2021-01-04T00:00:00
db:NVDid:CVE-2020-35496date:2021-01-04T15:15:14.323