Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 711324 (CVE-2019-17450, CVE-2019-17451) - <sys-devel/binutils-2.33.1: Multiple vulnerabilities (CVE-2019-{14444,17450,17451})
Summary: <sys-devel/binutils-2.33.1: Multiple vulnerabilities (CVE-2019-{14444,17450,1...
Alias: CVE-2019-17450, CVE-2019-17451
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa+ cve masked]
Depends on:
Reported: 2020-03-02 15:11 UTC by Sam James
Modified: 2020-07-27 00:51 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-02 15:11:02 UTC
"apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf."

Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2020-04-17 21:09:07 UTC
CVE-2019-17451 (
  An issue was discovered in the Binary File Descriptor (BFD) library (aka
  libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow
  leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as
  demonstrated by nm.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2020-04-17 21:09:36 UTC
CVE-2019-17450 (
  find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD)
  library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote
  attackers to cause a denial of service (infinite recursion and application
  crash) via a crafted ELF file.
Comment 3 Larry the Git Cow gentoo-dev 2020-04-26 00:33:52 UTC
The bug has been referenced in the following commit(s):

commit cf7bc8cee05a4dd95af28b48b66dd5a93e48a5c8
Author:     Andreas K. Hüttel <>
AuthorDate: 2020-04-26 00:32:31 +0000
Commit:     Andreas K. Hüttel <>
CommitDate: 2020-04-26 00:33:36 +0000

    package.mask: Mask <binutils-2.33.1, bug 711324
    Signed-off-by: Andreas K. Hüttel <>

 profiles/package.mask | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
Comment 4 Andreas K. Hüttel archtester gentoo-dev 2020-04-26 00:34:46 UTC
No cleanup, but all masked.
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-26 00:40:47 UTC
(In reply to Andreas K. Hüttel from comment #4)
> No cleanup, but all masked.

Good enough for toolchain stuff. Thanks.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2020-07-27 00:51:42 UTC
This issue was resolved and addressed in
 GLSA 202007-39 at
by GLSA coordinator Sam James (sam_c).