CVE-2021-20284

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	binutils	Binutils 2.35.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1937784Exploit, Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202208-30Third Party Advisory
https://security.netapp.com/advisory/ntap-20210521-0010/Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=26931Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1937784Exploit, Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202208-30Third Party Advisory
https://security.netapp.com/advisory/ntap-20210521-0010/Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=26931Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Mar 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202856.6A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflo CVE-2021-202862.7A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.CVE-2021-202887.2An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn'CVE-2021-202895.3A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the CVE-2021-20299.8Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected ar CVE-2021-202906.1An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute acti CVE-2021-202916.5A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each l CVE-2021-202926.7There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm i CVE-2021-202936.1A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly h CVE-2021-202947.8A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could t CVE-2021-202956.5It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum r CVE-2021-202965.3A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decomp