CVE-2021-45078

HIGH

GNU Binutils < 2.37 - Out-of-Bounds Write

Title source: rule

Description

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

References (6)

[Third Party Advisory] https://security.gentoo.org/glsa/202208-30

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20220107-0002/

[Exploit, Issue Tracking, Patch, Third Party Advisory] https://sourceware.org/bugzilla/show_bug.cgi?id=28694

[Patch] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=161e87d12167b1e36193385485c1f6ce92f74f02

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQBH244M5PV6S6UMHUTCVCWFZDX7Y4M6/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUHLDDT3HH7YEY6TX7IJRGPJUTNNVEL3/

Scores

CVSS v3 7.8

EPSS 0.0016

EPSS Percentile 36.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-787

Status published

Affected Products (8)

gnu/binutils < 2.37

fedoraproject/fedora

fedoraproject/fedora

redhat/enterprise_linux

debian/debian_linux

debian/debian_linux

debian/debian_linux

netapp/ontap_select_deploy_administration_utility

Timeline

Published Dec 15, 2021

Tracked Since Feb 18, 2026