CVE-2020-35494 Null dereference in binutils
An attacker can cause denial of service and potential information disclosure in binutils by submitting a crafted input file that triggers uninitialized memory usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-35494?
CVE-2020-35494 is a medium-severity vulnerability in Fedoraproject Fedora, published on 4 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.
Weakness: CWE-908
Which versions are affected by CVE-2020-35494?
It affects 8 products.
Products include Broadcom Brocade Fabric Operating System Firmware, Fedoraproject Fedora, Gnu Binutils, Netapp Cloud Backup, Netapp Hci Compute Node Firmware, Netapp Ontap Select Deploy Administration Utility and 2 more.
How do I fix CVE-2020-35494?
Upgrade to a fixed version.
Is CVE-2020-35494 being exploited?
There is no known exploitation of CVE-2020-35494 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-35494, GHSA-4cpw-77g4-8rhj.