CVE-2019-12972

An out-of-bounds read was discovered in Binutils while it processes a malformed ELF relocatable file (.o file). A victim user who uses Binutils tools (size, gdb, readelf) to analyze untrusted binaries, may be vulnerable to a denial of service attack.

Exploitation of this bug specifically requires the victim to analyze a maliciously crafted binary using a tool that uses a vulnerable version of libbfd. No binary under normal circumstances, omits the '\0' in SHT_GROUP, that is a prerequisite for this attack to work.

It is neither common practice, nor recommended to analyze untrusted binaries outside a sandbox. Therefore RH ProdSec has set the Impact of this bug to "Low".

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.