CVE-2020-16592

MEDIUM

GNU Binutils - Use After Free

Title source: rule

Description

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

References (5)

[Patch] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7ecb51549ab1ec22aba5aaf34b70323cf0b8509a

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20210115-0003/

[Exploit, Issue Tracking, Third Party Advisory] https://sourceware.org/bugzilla/show_bug.cgi?id=25823

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKIMSD5FIC3QFJDKNHR2PSO6JYJGCLHB/

Scores

CVSS v3 5.5

EPSS 0.0034

EPSS Percentile 56.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-416

Status published

Affected Products (4)

gnu/binutils

netapp/ontap_select_deploy_administration_utility

fedoraproject/fedora

Timeline

Published Dec 09, 2020

Tracked Since Feb 18, 2026