CVE-2020-35496 Null dereference in binutils

What is CVE-2020-35496?

CVE-2020-35496 is a medium-severity vulnerability in Fedoraproject Fedora, published on 4 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

Weakness: CWE-476

Which versions are affected by CVE-2020-35496?

It affects 8 products.

Products include Broadcom Brocade Fabric Operating System Firmware, Fedoraproject Fedora, Gnu Binutils, Netapp Cloud Backup, Netapp Hci Compute Node Firmware, Netapp Ontap Select Deploy Administration Utility and 2 more.

How do I fix CVE-2020-35496?

Upgrade to a fixed version.

Is CVE-2020-35496 being exploited?

There is no known exploitation of CVE-2020-35496 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2023-27534 Path traversal in https://github.com/curl/curl High 8.8
• CVE-2021-4197 Privilege escalation in kernel High 7.8
• CVE-2023-27538 Auth bypass in https://github.com/curl/curl High 7.7
• CVE-2021-27218 Integer overflow in n/a High 7.5
• CVE-2021-27219 Integer overflow in n/a High 7.5

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-35496, GHSA-grgx-vvhc-gxxr.