oesa-2025-2413
Vulnerability from osv_openeuler
GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.
Security Fix(es):
A critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with "[f]ixed for 2.46". Applying the patch ea1a0737c7692737a644af极速时时彩0486b71e4a392极速时时彩cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)
A vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"gdb-11.1-12.oe2203sp3.aarch64.rpm",
"gdb-debuginfo-11.1-12.oe2203sp3.aarch64.rpm",
"gdb-debugsource-11.1-12.oe2203sp3.aarch64.rpm",
"gdb-gdbserver-11.1-12.oe2203sp3.aarch64.rpm",
"gdb-headless-11.1-12.oe2203sp3.aarch64.rpm"
],
"noarch": [
"gdb-help-11.1-12.oe2203sp3.noarch.rpm"
],
"src": [
"gdb-11.1-12.oe2203sp3.src.rpm"
],
"x86_64": [
"gdb-11.1-12.oe2203sp3.x86_64.rpm",
"gdb-debuginfo-11.1-12.oe2203sp3.x86_64.rpm",
"gdb-debugsource-11.1-12.oe2203sp3.x86_64.rpm",
"gdb-gdbserver-11.1-12.oe2203sp3.x86_64.rpm",
"gdb-headless-11.1-12.oe2203sp3.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS-SP3",
"name": "gdb",
"purl": "pkg:rpm/openEuler/gdb\u0026distro=openEuler-22.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.1-12.oe2203sp3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "GDB, the GNU Project debugger, allows you to see what is going on inside another program while it executes -- or what another program was doing at the moment it crashed.\r\n\r\nSecurity Fix(es):\n\nA critical vulnerability was found in GNU Binutils version 2.45. This vulnerability is classified as CWE-122 heap-based buffer overflow. A heap overflow condition is a buffer overflow where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted are confidentiality, integrity, and availability. The exploit is available at sourceware.org and is declared as proof-of-concept. The code maintainer replied with \u0026quot;[f]ixed for 2.46\u0026quot;. Applying the patch ea1a0737c7692737a644af\u6781\u901f\u65f6\u65f6\u5f690486b71e4a392\u6781\u901f\u65f6\u65f6\u5f69cbca8 is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11082)\n\nA vulnerability classified as problematic was found in GNU Binutils 2.45. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. It is possible to download the exploit at sourceware.org. It is declared as proof-of-concept. Applying the patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a is able to eliminate this problem. The bugfix is ready for download at sourceware.org.(CVE-2025-11494)",
"id": "OESA-2025-2413",
"modified": "2026-08-06T11:09:29Z",
"published": "2025-10-17T11:09:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2413"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11082"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11494"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "gdb security update",
"upstream": [
"CVE-2025-11082",
"CVE-2025-11494"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.