CVE-2018-17359

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
https://sourceware.org/bugzilla/show_bug.cgi?id=23686Exploit, Issue Tracking, Third Party Advisory
https://usn.ubuntu.com/4336-1/
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
https://sourceware.org/bugzilla/show_bug.cgi?id=23686Exploit, Issue Tracking, Third Party Advisory
https://usn.ubuntu.com/4336-1/

Timeline

Published: Sep 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17366.1IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By per CVE-2018-173605.5An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer o CVE-2018-173616.1Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.ph CVE-2018-173648.1OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.CVE-2018-173657.5SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.CVE-2018-173668.8An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.CVE-2018-173685.3An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the us CVE-2018-173694.8An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or descriptio CVE-2018-173749.8SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.CVE-2018-173759.8SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.CVE-2018-173769.8SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter_letter parameter.CVE-2018-173779.8SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.