CVE-2012-3509

Impact:
Moderate
Public Date:
2012-08-29
CWE:
CWE-190->CWE-122
Bugzilla:
849693: CVE-2012-3509 libiberty: integer overflow, leading to heap-buffer overflow by processing certain file headers via bfd binary

The MITRE CVE dictionary describes this issue as:

Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.

Find out more about CVE-2012-3509 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

The versions of the gdb package, as shipped with Red Hat Enterprise Linux 5 and 6 are vulnerable to the original libiberty integer overflow flaw. But due the way of subsequent processing of the previously insufficiently pre-allocated libiberty buffer within gdb code, the impact of this issue is limited to crash only. Red Hat Security Response Team does not consider crash of end-user application, such as gdb, to be a security flaw.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 6.8
Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 6 mingw32-binutils Will not fix
Red Hat Enterprise Linux 6 gcc Not affected
Red Hat Enterprise Linux 6 mingw32-gcc Not affected
Red Hat Enterprise Linux 6 compat-gcc-296 Not affected
Red Hat Enterprise Linux 6 crash Will not fix
Red Hat Enterprise Linux 6 binutils Will not fix
Red Hat Enterprise Linux 6 gdb Not affected
Red Hat Enterprise Linux 6 compat-gcc-32 Not affected
Red Hat Enterprise Linux 6 compat-gcc-34 Not affected
Red Hat Enterprise Linux 6 compat-gcc-295 Not affected
Red Hat Enterprise Linux 5 compat-gcc-34 Not affected
Red Hat Enterprise Linux 5 gcc Not affected
Red Hat Enterprise Linux 5 compat-gcc-32 Not affected
Red Hat Enterprise Linux 5 binutils Will not fix
Red Hat Enterprise Linux 5 gcc44 Not affected
Red Hat Enterprise Linux 5 crash Will not fix
Red Hat Enterprise Linux 5 compat-gcc-296 Not affected
Red Hat Enterprise Linux 5 compat-gcc-295 Not affected
Red Hat Enterprise Linux 5 gdb Not affected
Red Hat Enterprise Linux 5 binutils220 Will not fix

This page is generated automatically and has not been checked for errors or omissions.

For clarification or corrections please contact Red Hat Product Security.

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.