GHSA-3frg-24qp-xxv2

GHSA-3frg-24qp-xxv2 PUBLISHED CVSS 3.0999999046325684 LOW

Record from GitHub Advisory Database · Published February 10, 2025

A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
binutils	Wolfi	2.45-r0
binutils	Chainguard	2.45-r0

Risk scores

CVSS 3.1

3.0999999046325684

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
wolfi	binutils	0
chainguard	binutils	0

Timeline

Feb 10, 2025 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-3frg-24qp-xxv2
vulnetix vdb fixes GHSA-3frg-24qp-xxv2

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-3frg-24qp-xxv2/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →