CVE-2018-6323

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
http://www.securityfocus.com/bid/102821Third Party Advisory, VDB Entry
https://sourceware.org/bugzilla/show_bug.cgi?id=22746Exploit, Issue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/44035/Exploit, Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
http://www.securityfocus.com/bid/102821Third Party Advisory, VDB Entry
https://sourceware.org/bugzilla/show_bug.cgi?id=22746Exploit, Issue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/44035/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63246.1F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login.CVE-2018-63289.8It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allo CVE-2018-63299.8It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a CVE-2018-63308.8Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.CVE-2018-63319.8Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it CVE-2018-63325.9A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate CVE-2018-63339.8The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malici CVE-2018-63349.8Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly CVE-2018-63357.5A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. T CVE-2018-63367.8An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing CVE-2018-63377.5folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked child CVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off