CVE-2018-20657

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted st… (CVE-2018-20657)

Description

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

Source: CVELISTV5 NVD

Metrics

Severity

high

91.49

—

no public PoC known

7.5

Source: nvd-v3

CVSS v3

7.5

CVSS v4

—

EPSS percentile

90.0 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

4.0 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2019-01-02 14:00 UTC

CWE

—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

f5
traffix_signaling_delivery_controller5.0.0 – 5.1.0
f5
traffix_signaling_delivery_controller
gnu
binutils

References & sources

IDCVE-2018-20657