CVE-2005-4807

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the as_bad function in messages.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050721 allows attackers to execute arbitrary code via a .c file with crafted inline assembly code.

Affected products

Canonical Ubuntu Linux: 5.04, 5.10
GNU Binutils: before 2.17 — fixed in 2.17

How to fix

Upgrade to a fixed version: GNU Binutils 2.17. Check the vendor advisory for mitigations.

References

http://bugs.gentoo.org/show_bug.cgi?id=99464
http://secunia.com/advisories/21508
http://secunia.com/advisories/21530
http://www.osvdb.org/27960
http://www.securityfocus.com/bid/19555
http://www.ubuntu.com/usn/usn-336-1
http://www.vupen.com/english/advisories/2006/3307
http://bugs.gentoo.org/show_bug.cgi?id=99464
http://secunia.com/advisories/21508
http://secunia.com/advisories/21530
http://www.osvdb.org/27960
http://www.securityfocus.com/bid/19555

Get alerted when CVE-2005-4807 or the next vulnerability affects your stack