Vulnerability Details : CVE-2022-38533
In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2022-38533
- cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-38533
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-38533
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2022-38533
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-38533
-
https://sourceware.org/bugzilla/show_bug.cgi?id=29482
29482 – strip: heap-buffer-overflow in coff_set_section_contentsIssue Tracking;Patch;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20221104-0007/
CVE-2022-38533 GNU Binutils Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://github.com/bminor/binutils-gdb/commit/45d92439aebd0386ef8af76e1796d08cfe457e1d
PR29495, rewrite_elf_program_header looping · bminor/binutils-gdb@45d9243 · GitHub
-
https://sourceware.org/bugzilla/show_bug.cgi?id=29482#c2
29482 – strip: heap-buffer-overflow in coff_set_section_contentsIssue Tracking;Patch;Third Party Advisory
-
https://sourceware.org/bugzilla/show_bug.cgi?id=29495
29495 – rewrite_elf_program_header looping
-
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=45d92439aebd0386ef8af76e1796d08cfe457e1d
sourceware.org Git - binutils-gdb.git/commit
-
https://security.gentoo.org/glsa/202309-15
GNU Binutils: Multiple Vulnerabilities (GLSA 202309-15) — Gentoo security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AKZ2DTS3ATVN5PANNVLKLE5OP4OF25Q/
[SECURITY] Fedora 36 Update: mingw-binutils-2.37-5.fc36 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MTEHT3G6YKJ7F7MSGWYSI4UM3XBAYXZ/
[SECURITY] Fedora 37 Update: mingw-binutils-2.38-5.fc37 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to