VDB
CNVD-2025-03960
CNVD-2025-03960
PUBLISHED
CVSS 2.299999952316284 LOW
GNU Binutils（GNU Binary Utilities）是美国GNU社区的开发的一组编程语言工具程序。该程序主要用于处理多种格式的目标文件，并提供有连接器、汇编器和其他用于目标文件和档案的工具。 GNU Binutils 2.43版本存在缓冲区溢出漏洞，该漏洞源于nm部件的binutils/nm.c文件中的__sanitizer::internal_strlen函数未能正确验证输入数据的长度大小，远程攻击者可利用该漏洞在系统上执行任意代码或者导致拒绝服务。
Risk Scores
CVSS 4.0
2.299999952316284
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| GNU | Binutils | 2.43 |
Timeline
- Feb 10, 2025 CVE Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 14, 2025 PoC Published
- Feb 17, 2025 CVE ID Reserved
- Feb 17, 2025 CVE Updated
- Apr 4, 2025 PoC Published
References
- VDB-295051 | GNU Binutils nm nm.c internal_strlen buffer overflow vdb
- VDB-295051 | CTI Indicators (IOB, IOC, IOA) url
- Submit #485254 | GNU binutils/nm 2.43 Buffer Overflow third-party-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=32556 issue
- https://sourceware.org/bugzilla/attachment.cgi?id=15881 exploit
- https://www.gnu.org/ url
- https://security.netapp.com/advisory/ntap-20250404-0003/ url