CVE-2020-35507 Null dereference in binutils
An attacker can cause a denial of service in objdump by submitting a crafted file that triggers a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-35507?
CVE-2020-35507 is a medium-severity vulnerability in Gnu Binutils, published on 4 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.
Weakness: CWE-476
Which versions are affected by CVE-2020-35507?
It affects 8 products.
Products include Broadcom Brocade Fabric Operating System, Gnu Binutils, Netapp Cloud Backup, Netapp Hci Compute Node Firmware, Netapp Ontap Select Deploy Administration Utility, Netapp Solidfire\, Enterprise Sds \& Hci Storage Node and 2 more.
How do I fix CVE-2020-35507?
Upgrade to a fixed version.
Is CVE-2020-35507 being exploited?
There is no known exploitation of CVE-2020-35507 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as DEBIAN-CVE-2020-35507, GHSA-87mc-cvfv-8r2w.