CVE-2018-18309

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
• http://www.securityfocus.com/bid/105692Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=23770Exploit, Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0930cb3021b8078b34cf216e79eb8608d017864f
• https://usn.ubuntu.com/4336-1/
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
• http://www.securityfocus.com/bid/105692Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=23770Exploit, Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0930cb3021b8078b34cf216e79eb8608d017864f
• https://usn.ubuntu.com/4336-1/

Published

Oct 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1829IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable…5.4
• CVE-2018-18290An issue was discovered in nc-cms through 2017-03-10. index.…
• CVE-2018-18291A cross site scripting (XSS) vulnerability on ASUS RT-AC58U …
• CVE-2018-18296MetInfo 6.1.2 has XSS via the /admin/index.php bigclass para…
• CVE-2018-18307A Stored XSS vulnerability has been discovered in version 4.…
• CVE-2018-18308In the 4.2.23 version of BigTree, a Stored XSS vulnerability…
• CVE-2018-18310An invalid memory address dereference was discovered in dwfl…5.5
• CVE-2018-18311Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer ove…
• CVE-2018-18312Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer ove…
• CVE-2018-18313Perl before 5.26.3 has a buffer over-read via a crafted regu…
• CVE-2018-18314Perl before 5.26.3 has a buffer overflow via a crafted regul…
• CVE-2018-18315com/mossle/cdn/CdnController.java in lemon 1.9.0 allows atta…