CVE-2018-18309

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-183105.5An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerabilit CVE-2018-183119.8Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-183129.8Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-183139.1Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process me CVE-2018-183149.8Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-183157.5com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in Cd CVE-2018-183168.8emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.CVE-2018-183178.8DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI.CVE-2018-183187.5The /dev/block/mmcblk0rpmb driver kernel module on Qiku 360 Phone N6 Pro 1801-A01 devices allows attackers to cause a denial of service (NUL CVE-2018-183199.8An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api CVE-2018-183209.8An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exe CVE-2018-183229.8CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start