{"id":"CVE-2023-25586","state":"PUBLISHED","title":"Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized","description":"A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.","publishedAt":"2023-09-14T20:49:15.468Z","updatedAt":"2025-02-13T16:44:33.064Z","severity":{"score":4.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a binutils","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Fedora Fedora 36","Fedora Fedora 37","Fedora Extra Packages for Enterprise Linux 7","Fedora Fedora","Fedora Extra Packages for Enterprise Linux 8"],"affected":[{"vendor":"n/a","product":"binutils","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-11-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-11-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-12-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-12-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gcc-toolset-12-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gcc-toolset-12-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora 36","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"mingw-binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 7","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"insight","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"mingw-binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"insight","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 8","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 8","packageName":"rizin","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"rizin","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2023-25586","https://bugzilla.redhat.com/show_bug.cgi?id=2167502","https://sourceware.org/bugzilla/show_bug.cgi?id=29855","https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502","https://security.netapp.com/advisory/ntap-20231103-0003/"],"weaknesses":["CWE-457"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/25xxx/CVE-2023-25586.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-25586","state":"PUBLISHED","datePublished":"2023-09-14T20:49:15.468Z","dateUpdated":"2025-02-13T16:44:33.064Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-02-07T19:03:20.221Z"},"containers":{"cna":{"title":"Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized","descriptions":[{"lang":"en","value":"A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service."}],"affected":[{"vendor":"n/a","product":"binutils","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-11-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-11-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-12-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gcc-toolset-12-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gcc-toolset-12-binutils","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gcc-toolset-12-gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora 36","packageName":"gdb","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"mingw-binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 7","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"insight","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 37","packageName":"mingw-binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"insight","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"binutils","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 8","packageName":"radare2","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux 8","packageName":"rizin","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora 36","packageName":"rizin","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-25586","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167502","name":"RHBZ#2167502","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=29855"},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502"},{"url":"https://security.netapp.com/advisory/ntap-20231103-0003/"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-457","description":"Use of Uninitialized Variable","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2023-11-04T05:07:13.976Z"},"datePublic":"2022-12-12T00:00:00.000Z","x_redhatCweChain":"CWE-457: Use of Uninitialized Variable","timeline":[{"lang":"en","time":"2023-01-12T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2022-12-12T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-25586","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167502","name":"RHBZ#2167502","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=29855","tags":["x_transferred"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231103-0003/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:25:19.230Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-25T18:21:11.697914Z","id":"CVE-2023-25586","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-25T18:21:19.562Z"}}]}}}