Out-of-Bounds Affecting binutils package, versions <2.25.90.20151125-1
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.26% (66th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-BINUTILS-514740
- published 21 Mar 2017
- disclosed 21 Mar 2017
Introduced: 21 Mar 2017
CVE-2014-9939 Open this link in a new tabHow to fix?
Upgrade Debian:11 binutils to version 2.25.90.20151125-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.
References
- https://security-tracker.debian.org/tracker/CVE-2014-9939
- https://sourceware.org/bugzilla/show_bug.cgi?id=18750
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7e27a9d5f22f9f7ead11738b1546d0b5c737266b
- http://www.openwall.com/lists/oss-security/2015/07/31/6
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-9939
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7e27a9d5f22f9f7ead11738b1546d0b5c737266b