Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-20657: GNU Binutils Memory Leak via Malformed String
CVE-2018-20657 · published 7 years ago
Summary
A memory leak in GNU Binutils can cause the software to consume excessive memory, leading to a denial of service. This issue affects users who rely on the software to function correctly. To mitigate the risk, update to a fixed version of GNU Binutils.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gnu | binutils |
2.31.1 cpe:2.3:a:gnu:binutils:2.31.1:*:*:*:*:*:*:* |
| f5 | traffix_signaling_delivery_controller |
>= 5.0.0, <= 5.1.0 4.4.0 cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* |
Original advisory text
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), a...
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.
References
- http://www.securityfocus.com/bid/106444 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2019:3352
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539 Exploit Issue Tracking Third Party Advisory
- https://support.f5.com/csp/article/K62602089 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-772Missing Release of Resource after Effective Lifetime
Timeline
Published2 Jan 2019
Updated24 Oct 2026
First seen30 Jul 2026
Track software like this
Free during beta