VulnerabilityModified

CVE-2020-16592

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

MEDIUM 5.5EPSS 1.06%

Does this matter?

Lower severity and a low EPSS score (1.06%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 1.06% probability · 63th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: gnu/binutils · netapp/ontap select deploy administration utility · fedoraproject/fedora
Source: cve@mitre.org

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKIMSD5FIC3QFJDKNHR2PSO6JYJGCLHB/
https://security.netapp.com/advisory/ntap-20210115-0003/Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=25823Exploit, Issue Tracking, Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7ecb51549ab1ec22aba5aaf34b70323cf0b8509a
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKIMSD5FIC3QFJDKNHR2PSO6JYJGCLHB/
https://security.netapp.com/advisory/ntap-20210115-0003/Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=25823Exploit, Issue Tracking, Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7ecb51549ab1ec22aba5aaf34b70323cf0b8509a

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.