Vulnerability Details : CVE-2019-17451
Potential exploit
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.
Vulnerability category: Overflow
Products affected by CVE-2019-17451
- cpe:2.3:a:gnu:binutils:2.32:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-17451
0.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-17451
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2019-17451
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-17451
-
https://security.netapp.com/advisory/ntap-20191024-0002/
October 2019 GNU Binutils Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html
[security-announce] openSUSE-SU-2020:1790-1: moderate: Security update fMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202007-39
Binutils: Multiple vulnerabilities (GLSA 202007-39) — Gentoo securityThird Party Advisory
-
https://sourceware.org/bugzilla/show_bug.cgi?id=25070
25070 – SEGV in function _bfd_dwarf2_find_nearest_lineExploit;Issue Tracking;Third Party Advisory
-
https://usn.ubuntu.com/4336-1/
USN-4336-1: GNU binutils vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=336bfbeb1848f4b9558456fdcf283ee8a32d7fd1
sourceware.org Git - binutils-gdb.git/commitMailing List
-
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html
[security-announce] openSUSE-SU-2020:1804-1: moderate: Security update fMailing List;Third Party Advisory
Jump to