Bug 2400339

Summary:	CVE-2025-11081 binutils: GNU Binutils out-of-bounds read [fedora-42]
Product:	[Fedora] Fedora	Reporter:	Jon Moroney <jmoroney>
Component:	binutils	Assignee:	Nick Clifton <nickc>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	42	CC:	dvlasenk, fweimer, jakub, josmyers, nickc, sipoyare, suraj.ghimire7
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["26d478e1-dc8b-4442-9077-71f58bf2e722"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-10-03 10:56:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2399944

Description Jon Moroney 2025-09-29 22:10:15 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Nick Clifton 2025-10-03 10:52:39 UTC

Note - this bug should not have qualified for CVE status.  It affects a binary examination tool (objdump) not a binary creation tool (ie the assembler & linker).  The Binutils SECURITY.txt file clearly indicates that bugs in examination tools are not considered to be security issues.

Comment 2 Nick Clifton 2025-10-03 10:56:00 UTC

I am closing this BZ.  The reported bug only affects code that handles the SHT_GNU_SFRAME section type, and this type was only introduced with the 2.45 GNU Binutils release.  Since the Fedora 42 binutils release is based upon the 2.44 GNU binutils, it is not affected by the bug.