CVE-2019-9074 : An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd)

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c.

Published 2019-02-24 00:29:00

Updated 2021-12-10 20:11:52

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-9074

GNU » Binutils » Version: 2.32
cpe:2.3:a:gnu:binutils:2.32:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Netapp » Hci Management Node » Version: N/A
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Solidfire » Version: N/A
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-9074

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-9074

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-9074

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-9074

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html

[security-announce] openSUSE-SU-2020:1790-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://sourceware.org/bugzilla/show_bug.cgi?id=24235

24235 – objdump: Read memory violation in libbfd.c
Exploit;Issue Tracking;Third Party Advisory
https://usn.ubuntu.com/4336-1/

USN-4336-1: GNU binutils vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202107-24

Binutils: Multiple vulnerabilities (GLSA 202107-24) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html

[security-announce] openSUSE-SU-2020:1804-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://support.f5.com/csp/article/K09092524

Third Party Advisory
https://security.netapp.com/advisory/ntap-20190314-0003/

February 2019 GNU Binutils Vulnerabilities in NetApp Products | NetApp Product Security
Patch;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-9074

Products affected by CVE-2019-9074

Exploit prediction scoring system (EPSS) score for CVE-2019-9074

CVSS scores for CVE-2019-9074

CWE ids for CVE-2019-9074

References for CVE-2019-9074