Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

binutils: Malicious files can crash objdump

CVE-2020-35496 · published 5 years ago
Summary

An attacker can submit a specially crafted file to objdump, causing it to crash. This could disrupt your workflow if you rely on objdump to analyze files. Update to binutils version 2.34 or later to fix this issue.

What to do
  • Update gnu binutils to version 2.34 or later.
Affected software
VendorProductAffected versions
gnu binutils < 2.34
cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*
fedoraproject fedora 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
netapp cloud_backup All versions
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netapp ontap_select_deploy_administration_utility All versions
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
netapp solidfire\,_enterprise_sds_\&_hci_storage_node All versions
cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
netapp solidfire_\&_hci_management_node All versions
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
broadcom brocade_fabric_operating_system_firmware All versions
cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*
netapp hci_compute_node_firmware All versions
cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
– binutils binutils 2.34
Original advisory text
There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer derefer...
There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published4 Jan 2021
Updated4 Nov 2026
First seen30 Jul 2026
Sources
CVE-2020-35496 · OSV
CVE-2020-35496 · NVD
CVE-2020-35496 · MITRE
Track software like this
Free during beta