CVE-2014-8485

Published: Dec 9, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

Affected (8)

Products: Fedoraproject: Fedora · Canonical: Ubuntu Linux · Gnu: Binutils

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 19
Fedoraproject Fedora	Version 20
Fedoraproject Fedora	Version 21

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Binutils	Up to 2.24

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (30)

http://lcamtuf.blogspot.co.uk/2014/10/psa-dont-run-strings-on-untrusted-files.html

Source: cve@mitre.org

ExploitPress/Media Coverage

http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/62241

Source: cve@mitre.org

Permissions RequiredThird Party Advisory

http://secunia.com/advisories/62746

Source: cve@mitre.org

Permissions RequiredThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:029

Source: cve@mitre.org

Broken Link

http://www.openwall.com/lists/oss-security/2014/10/26/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/70741

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2496-1

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1157276

Source: cve@mitre.org

Broken Link

https://security.gentoo.org/glsa/201612-24

Source: cve@mitre.org

https://sourceware.org/bugzilla/show_bug.cgi?id=17510

Source: cve@mitre.org

Issue Tracking

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Ba=commit%3Bh=493a33860c71cac998f1a56d6d87d6faa801fbaa

Source: cve@mitre.org

http://lcamtuf.blogspot.co.uk/2014/10/psa-dont-run-strings-on-untrusted-files.html