Bug 2400339 - CVE-2025-11081 binutils: GNU Binutils out-of-bounds read [fedora-42]
Summary: CVE-2025-11081 binutils: GNU Binutils out-of-bounds read [fedora-42]
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: binutils
Version: 42
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Nick Clifton
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["26d478e1-dc8b-4442-9077-7...
Depends On:
Blocks: CVE-2025-11081
TreeView+ depends on / blocked
 
Reported: 2025-09-29 22:10 UTC by Jon Moroney
Modified: 2025-10-03 10:56 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-10-03 10:56:00 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jon Moroney 2025-09-29 22:10:15 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Nick Clifton 2025-10-03 10:52:39 UTC
Note - this bug should not have qualified for CVE status.  It affects a binary examination tool (objdump) not a binary creation tool (ie the assembler & linker).  The Binutils SECURITY.txt file clearly indicates that bugs in examination tools are not considered to be security issues.

Comment 2 Nick Clifton 2025-10-03 10:56:00 UTC
I am closing this BZ.  The reported bug only affects code that handles the SHT_GNU_SFRAME section type, and this type was only introduced with the 2.45 GNU Binutils release.  Since the Fedora 42 binutils release is based upon the 2.44 GNU binutils, it is not affected by the bug.


Note You need to log in before you can comment on or make changes to this bug.