Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Azure Binutils before 2.41-11 allow remote overflow
published 1 year ago
Summary
Versions of Azure's Binutils package older than 2.41-11 contain a coding mistake that can let an attacker cause a program to write beyond its intended memory area, potentially leading to remote code execution. This risk is hard to exploit but a public proof exists, so it should be taken seriously. Update Binutils to version 2.41-11 or later, or apply the vendor's security patch, to remove the problem.
What to do
- Update azure binutils to version 2.41-11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | binutils |
< 2.41-11 Fix: upgrade to 2.41-11
|
Original advisory text
CVE-2025-1147 affecting package binutils for versions less than 2.41-11
A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published10 Feb 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-56603 · OSV
Track software like this
Free during beta