CVE-2020-35342

Published: 22 August 2023

GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.

Notes

Author	Note
seth-arnold	binutils isn't safe for untrusted inputs.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
binutils Launchpad, Ubuntu, Debian	trusty	Released (2.24-5ubuntu14.2+esm3) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	bionic	Released (2.30-21ubuntu1~18.04.9+esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	focal	Not vulnerable (2.34-6ubuntu1)
	jammy	Not vulnerable (2.38-3ubuntu1)
	lunar	Not vulnerable (2.40-2ubuntu4)
	upstream	Released (2.34)
	xenial	Released (2.26.1-1ubuntu1~16.04.8+esm7) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	Patches: upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8c5e259235a4e4546910245b170de1e29a711034 upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=2c5b6e1a1c406cbe06e2d6f77861764ebd01b9ce

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›