CVE-2018-20712
Fixed in a distro release EPSS 3%
A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.
Products: gnu binutils
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | binutils | 2.32-r0 |
| Alpine 3.11 | binutils | 2.32-r0 |
| Alpine 3.12 | binutils | 2.32-r0 |
| Alpine 3.13 | binutils | 2.32-r0 |
| Alpine 3.14 | binutils | 2.32-r0 |
| Alpine 3.15 | binutils | 2.32-r0 |
| Alpine 3.16 | binutils | 2.32-r0 |
| Alpine 3.17 | binutils | 2.32-r0 |
| Alpine 3.18 | binutils | 2.32-r0 |
| Alpine 3.19 | binutils | 2.32-r0 |
| Alpine 3.20 | binutils | 2.32-r0 |
| Alpine 3.21 | binutils | 2.32-r0 |
| Alpine 3.22 | binutils | 2.32-r0 |
| Alpine 3.23 | binutils | 2.32-r0 |
| Alpine 3.24 | binutils | 2.32-r0 |
| Arch Linux | binutils | 2.32-1 |
| Debian 12 | binutils | no fix |
| Debian 13 | binutils | no fix |
| Debian 14 | binutils | no fix |
| Ubuntu 16.04 LTS | libiberty | no fix |