CVE-2018-13033

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.

• CWE-770

• http://www.securityfocus.com/bid/104584Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3032Third Party Advisory
• https://security.gentoo.org/glsa/201908-01
• https://sourceware.org/bugzilla/show_bug.cgi?id=23361Exploit, Issue Tracking, Patch, Third Party Advisory
• https://usn.ubuntu.com/4336-1/
• http://www.securityfocus.com/bid/104584Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3032Third Party Advisory
• https://security.gentoo.org/glsa/201908-01
• https://sourceware.org/bugzilla/show_bug.cgi?id=23361Exploit, Issue Tracking, Patch, Third Party Advisory
• https://usn.ubuntu.com/4336-1/

Published

Jul 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13025protected/apps/admin/controller/photoController.php in YXcms…
• CVE-2018-13026An issue was discovered in gpmf-parser 1.1.2. There is a hea…
• CVE-2018-1303A specially crafted HTTP request header could have crashed t…
• CVE-2018-13030An issue was discovered in jpeg-compressor 0.1. The build_hu…
• CVE-2018-13031DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin…
• CVE-2018-13032ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add s…
• CVE-2018-13034Directory traversal in Jester web framework 0.2.0 allows rem…
• CVE-2018-13037An issue was discovered in jpeg-compressor 0.1. The bmp_load…
• CVE-2018-13038OpenSID 18.06-pasca has an Unrestricted File Upload vulnerab…
• CVE-2018-13039OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS)…
• CVE-2018-1304The URL pattern of "" (the empty string) which exactly maps …
• CVE-2018-13040OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerabi…