CoreCVE
Back

HIGH

binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c.

Published Jun 23, 2018

Description

A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.

Affected products

Remediation

Red Hat statement

This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with objdump. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Metrics

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 23, 2018
Updated Aug 5, 2024
Reserved Jun 23, 2018
Link CVE-2018-12697
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-12697
Red Hat
Severity Low
Public date Apr 11, 2018
Links CVE-2018-12697 - Bugzilla