{
  "threat_severity" : "Low",
  "public_date" : "2018-04-11T00:00:00Z",
  "bugzilla" : {
    "description" : "binutils: heap-based buffer overflow in finish_stab in stabs.c",
    "id" : "1595427",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1595427"
  },
  "cvss3" : {
    "cvss3_base_score" : "0.0",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-122",
  "details" : [ "finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump." ],
  "statement" : "This is a vulnerability affecting binutils, a suite of tools for managing binaries on a linux system; as these tools are used by developers in compilation and debugging, the expected use case is a local user examining object files on a local filesystem, or using ssh to log in. Because of differences in how upstream sources and other vendors provide these utilities, other sources might report the impact of this flaw differently. However, while it is possible for specifically-crafted input to crash binutils via this flaw, Red Hat does not assess that it represents a significant security impact.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-11-14T00:00:00Z",
    "advisory" : "RHSA-2024:9689",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "binutils-0:2.30-125.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-11-14T00:00:00Z",
    "advisory" : "RHSA-2024:9689",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "binutils-0:2.30-125.el8_10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Will not fix",
    "package_name" : "binutils",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Will not fix",
    "package_name" : "binutils220",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Will not fix",
    "package_name" : "binutils",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "binutils",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "mingw-binutils",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2018-12699\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-12699" ],
  "name" : "CVE-2018-12699",
  "csaw" : false
}