CVE-2018-19931

HIGH7.8EPSS 0.31%

Published: 12/7/2018Modified: 4/28/2026

Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.

Affected packages (2)

Alpine/binutilsfrom 0, < 2.32-r0
Debian/binutilsfrom 0, < 2.32.51.20190707-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2018-19931
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2018-19931