Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Debian binutils can crash when processing malicious XCOFF files
published 2 months ago
Summary
The binutils tools used on Debian systems may stop working if they handle a specially crafted XCOFF object file. This happens because the program miscalculates how much memory to use, leading to a crash. Install the latest security update for the affected binutils packages to prevent the problem.
What to do
- Update debian binutils to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-aarch64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-alpha-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-arm-linux-gnueabi to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-arm-linux-gnueabihf to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-common to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-dev to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-doc to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-for-build to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-for-host to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-hppa-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-hppa64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-i686-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-i686-kfreebsd-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-i686-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-ia64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-m68k-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-mips-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-mips64el-linux-gnuabi64 to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-mipsel-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-multiarch to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-multiarch-dev to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-powerpc-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-powerpc-linux-gnuspe to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-powerpc64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-powerpc64le-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-riscv64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-s390x-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-sh4-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-source to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-sparc64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-x86-64-kfreebsd-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-x86-64-linux-gnu to version 2.31.1-16+tuxcare.els13.
- Update debian binutils-x86-64-linux-gnux32 to version 2.31.1-16+tuxcare.els13.
- Update debian libbinutils to version 2.31.1-16+tuxcare.els13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Debian:10 | debian | binutils |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-aarch64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-alpha-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-arm-linux-gnueabi |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-arm-linux-gnueabihf |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-common |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-dev |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-doc |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-for-build |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-for-host |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-hppa-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-hppa64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-i686-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-i686-kfreebsd-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-i686-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-ia64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-m68k-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-mips-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-mips64el-linux-gnuabi64 |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-mipsel-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-multiarch |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-multiarch-dev |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-powerpc-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-powerpc-linux-gnuspe |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-powerpc64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-powerpc64le-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-riscv64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-s390x-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-sh4-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-source |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-sparc64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-x86-64-kfreebsd-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-x86-64-linux-gnu |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | binutils-x86-64-linux-gnux32 |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
| TuxCare:Debian:10 | debian | libbinutils |
< 2.31.1-16+tuxcare.els13 Fix: upgrade to 2.31.1-16+tuxcare.els13
|
Original advisory text
Fix CVE(s): CVE-2026-6846
* SECURITY UPDATE: heap-based buffer overflow in xcoff_link_add_symbols
(bfd/xcofflink.c) triggered by a crafted XCOFF object file
- debian/patches/CVE-2026-6846.patch: size the reloc_info array by the
highest section target_index rather than by section_count, which the
XCOFF overflow-header handling decrements
- CVE-2026-6846
(bfd/xcofflink.c) triggered by a crafted XCOFF object file
- debian/patches/CVE-2026-6846.patch: size the reloc_info array by the
highest section target_index rather than by section_count, which the
XCOFF overflow-header handling decrements
- CVE-2026-6846
References
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786358668.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6846 Vendor Advisory
Timeline
Published10 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1786358668 · OSV
Track software like this
Free during beta