CVE-2019-1010204: gnu binutils gold Out-of-bounds Read
Vulnerability summary
CVE-2019-1010204 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in gnu binutils gold. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 23-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.11%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.11% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Affected systems
Gnu2 products
- binutils≥ 2.21, ≤ 2.31.1
- binutils_gold≥ 1.11, ≤ 1.16
Netapp2 products
Debian1 product
- binutils< 2.38.50.20220627-1
Gnu binutils1 product
- goldgold v1.11-v1.16 (GNU binutils v2.21-v2.31.1)
Opensuse1 product
- binutils&distro=openSUSE Tumbleweed< 2.39-1.1
Ubuntu1 product
- binutilsAll versions (No fix recorded) | < 2.26.1-1ubuntu1~16.04.8+esm4
6 vendors · 8 products
