Detections
Analytics
Alpine: multiple binutils packages: security update to 2.24-r2 (deprecated)
medium Tenable Cloud Security Plugin ID 401184
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier
allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact
via a crafted file. (CVE-2014-8504)
- The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to
cause a denial of service (out-of-bounds read) via a small S-record. (CVE-2014-8484)
- The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers
to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers
in an ELF file. (CVE-2014-8485)
- The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact
via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable. (CVE-2014-8501)
- Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and
earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified
impact via a truncated export table in a PE file. (CVE-2014-8502)
See Also
https://git.alpinelinux.org/aports/commit/?id=491d4e86baf9fcf4c526f827a70fc8d70b4fd899
https://git.alpinelinux.org/aports/commit/?id=6e866d5d899e7e93df6525c24b5560383ff34453
Plugin Details
Severity: Medium
ID: 401184
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-8504
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2014-8501
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/8/2014
Vulnerability Publication Date: 10/23/2014
Reference Information
CVE: CVE-2014-8484, CVE-2014-8485, CVE-2014-8501, CVE-2014-8502, CVE-2014-8503, CVE-2014-8504, CVE-2014-8737, CVE-2014-8738