CVE-2019-9077

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/107139Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/202107-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20190314-0003/Patch, Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=24243Exploit, Issue Tracking, Third Party Advisory
https://support.f5.com/csp/article/K00056379Third Party Advisory
https://usn.ubuntu.com/4336-1/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/107139Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/202107-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20190314-0003/Patch, Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=24243Exploit, Issue Tracking, Third Party Advisory
https://support.f5.com/csp/article/K00056379Third Party Advisory
https://usn.ubuntu.com/4336-1/Third Party Advisory

Timeline

Published: Feb 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-90785.4zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sC CVE-2019-90807.5DomainMOD before 4.14.0 uses MD5 without a salt for password storage.CVE-2019-90828.8ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app CVE-2019-90839.8SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued.CVE-2019-90844.9In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the CVE-2019-90856.5Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter t CVE-2019-90869.8HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter.CVE-2019-90879.8HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter.CVE-2019-90936.1A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplie CVE-2019-90946.1A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-s CVE-2019-90959.8An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3,CVE-2019-90969.8An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3,