CVE-2018-1000876

Published: 20 December 2018

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
binutils Launchpad, Ubuntu, Debian	Upstream	Released (2.32.51.20190707-1)

	Ubuntu 21.04 (Hirsute Hippo)	Not vulnerable (2.32-8ubuntu1)
	Ubuntu 20.04 LTS (Focal Fossa)	Not vulnerable (2.32-8ubuntu1)
	Ubuntu 18.04 LTS (Bionic Beaver)	Released (2.30-21ubuntu1~18.04.3)
	Ubuntu 16.04 ESM (Xenial Xerus)	Released (2.26.1-1ubuntu1~16.04.8+esm1)
	Ubuntu 14.04 ESM (Trusty Tahr)	Needs triage
	Patches: Upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3a551c7a1b80fca579461774860574eabfd7f18f

References

Bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=23994

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›