A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.

An update of the binutils package has been released.

The version of golang installed on the remote host is prior to 1.24.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2984 advisory.

    os/exec: LookPath may return unexpected paths. If the PATH environment variable contains paths which are     executables (rather than just directories), passing certain strings to LookPath (, ., and ..), can     result in the binaries listed in the PATH being unexpectedly returned. (CVE-2025-47906)

    Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to     the Scan method of the returned Rows can result in unexpected results if other queries are being made in     parallel. This can result in a race condition that may overwrite the expected results with those of     another query, causing the call to Scan to return either unexpected results from the other query or an     error. (CVE-2025-47907)

    A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability     is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer     overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be     used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to     fix this issue. (CVE-2025-7545)

    A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by     this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to     out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed     to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is     recommended to apply a patch to fix this issue. (CVE-2025-7546)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7718-1 advisory.

    It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a crash.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability     is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer     overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be     used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to     fix this issue. (CVE-2025-7545)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-200da46dc6 advisory.

    Backport fixes for CVE-2025-7545 and CVE-2025-7546.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a39532f9e1 advisory.

    Backport fixes for CVE-2025-7545 and CVE-2025-7546.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271247	Photon OS 5.0: Binutils PHSA-2025-5.0-0651	Nessus	PhotonOS Local Security Checks	medium
261346	Amazon Linux 2 : golang, --advisory ALAS2-2025-2984 (ALAS-2025-2984)	Nessus	Amazon Linux Local Security Checks	medium
258035	Ubuntu 16.04 LTS : GNU binutils vulnerability (USN-7718-1)	Nessus	Ubuntu Local Security Checks	medium
245465	Linux Distros Unpatched Vulnerability : CVE-2025-7545	Nessus	Misc.	medium
242877	Fedora 41 : mingw-binutils (2025-200da46dc6)	Nessus	Fedora Local Security Checks	medium
242876	Fedora 42 : mingw-binutils (2025-a39532f9e1)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-7545

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium