CVE-2018-6759

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-06 · updated 2026-06-17
Weakness: CWE-20

Description

The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.

Affected products

GNU Binutils: 2.30

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
http://www.securityfocus.com/bid/103030
https://security.gentoo.org/glsa/201811-17
https://sourceware.org/bugzilla/show_bug.cgi?id=22794
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
http://www.securityfocus.com/bid/103030
https://security.gentoo.org/glsa/201811-17
https://sourceware.org/bugzilla/show_bug.cgi?id=22794

Get alerted when CVE-2018-6759 or the next vulnerability affects your stack