Bug 2399948 (CVE-2025-11083) - CVE-2025-11083 binutils: GNU Binutils Linker heap-based overflow
Summary: CVE-2025-11083 binutils: GNU Binutils Linker heap-based overflow
Keywords:
Status: NEW
Alias: CVE-2025-11083
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2400261 2400263 2400265 2400268 2400274 2400276 2400278 2400280 2400289 2400293 2400295 2400338 2400341 2400347 2400357 2400362 2400364 2400257 2400270 2400283 2400299 2400302 2400304 2400309 2400312 2400314 2400317 2400319 2400321 2400325 2400330 2400333 2400336 2400344 2400349 2400354
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-09-28 00:01 UTC by OSIDB Bzimport
Modified: 2025-12-18 12:23 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:23232 0 None None None 2025-12-16 14:22:55 UTC
Red Hat Product Errata RHSA-2025:23233 0 None None None 2025-12-16 11:13:20 UTC
Red Hat Product Errata RHSA-2025:23306 0 None None None 2025-12-18 10:05:55 UTC
Red Hat Product Errata RHSA-2025:23336 0 None None None 2025-12-18 12:22:40 UTC
Red Hat Product Errata RHSA-2025:23343 0 None None None 2025-12-18 12:23:13 UTC
Red Hat Product Errata RHSA-2025:23359 0 None None None 2025-12-18 11:47:14 UTC
Red Hat Product Errata RHSA-2025:23382 0 None None None 2025-12-18 11:57:16 UTC
Red Hat Product Errata RHSA-2025:23400 0 None None None 2025-12-18 12:12:37 UTC
Red Hat Product Errata RHSA-2025:23405 0 None None None 2025-12-18 10:03:46 UTC

Description OSIDB Bzimport 2025-09-28 00:01:34 UTC 
A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".
Comment 2 errata-xmlrpc 2025-12-16 11:13:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:23233 https://access.redhat.com/errata/RHSA-2025:23233
Comment 3 errata-xmlrpc 2025-12-16 14:22:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:23232 https://access.redhat.com/errata/RHSA-2025:23232
Comment 4 errata-xmlrpc 2025-12-18 10:03:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2025:23405 https://access.redhat.com/errata/RHSA-2025:23405
Comment 5 errata-xmlrpc 2025-12-18 10:05:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:23306 https://access.redhat.com/errata/RHSA-2025:23306
Comment 6 errata-xmlrpc 2025-12-18 11:47:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:23359 https://access.redhat.com/errata/RHSA-2025:23359
Comment 7 errata-xmlrpc 2025-12-18 11:57:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:23382 https://access.redhat.com/errata/RHSA-2025:23382
Comment 8 errata-xmlrpc 2025-12-18 12:12:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2025:23400 https://access.redhat.com/errata/RHSA-2025:23400
Comment 9 errata-xmlrpc 2025-12-18 12:22:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:23336 https://access.redhat.com/errata/RHSA-2025:23336
Comment 10 errata-xmlrpc 2025-12-18 12:23:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:23343 https://access.redhat.com/errata/RHSA-2025:23343
Note You need to log in before you can comment on or make changes to this bug.