Vulnerability Details : CVE-2018-12698
Potential exploit
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
Products affected by CVE-2018-12698
- cpe:2.3:a:gnu:binutils:2.30:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-12698
2.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-12698
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
References for CVE-2018-12698
-
https://sourceware.org/bugzilla/show_bug.cgi?id=23057
23057 – Multiple memory corruptions in objdump (binuitils-2.30-15ubuntu1)Exploit;Issue Tracking;Third Party Advisory
-
https://security.gentoo.org/glsa/201908-01
Binutils: Multiple vulnerabilities (GLSA 201908-01) — Gentoo security
-
https://usn.ubuntu.com/4336-1/
USN-4336-1: GNU binutils vulnerabilities | Ubuntu security notices
-
https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102
Bug #1763102 “Multiple memory corruptions in objdump (binuitils-...” : Bugs : binutils package : UbuntuExploit;Third Party Advisory
-
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85454
85454 – Multiple memory corruptions in objdump / C++ name demangler (binuitils-2.30-15ubuntu1)Exploit;Issue Tracking;Vendor Advisory
-
https://usn.ubuntu.com/4326-1/
USN-4326-1: libiberty vulnerabilities | Ubuntu security notices
-
http://www.securityfocus.com/bid/104539
GNU libiberty CVE-2018-12698 Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
Jump to