CVE catalog

CVE-2021-20294

binutils: CVE-2021-20294

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.28% · Oct 25, 2026

A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbinutilssid2.47.50.20261021-1fixed
Debianbinutilsforky2.47.50.20261021-1fixed
Debianbinutilstrixie2.44-3fixed
Debianbinutilsbookworm2.40-2fixed
Susebinutilslinux enterprise module for basesystem 15 sp22.37-7.26.1fixed
Susebinutilslinux enterprise module for basesystem 15 sp32.37-7.26.1fixed
Susebinutilslinux enterprise module for development tools 15 sp22.37-7.26.1fixed
Susebinutilslinux enterprise module for development tools 15 sp32.37-7.26.1fixed
Susebinutilslinux enterprise module for package hub 15 sp22.37-7.26.1fixed
Susebinutilslinux enterprise module for package hub 15 sp32.37-7.26.1fixed
Susebinutilslinux enterprise high performance computing 15 sp1-espos2.37-7.26.1fixed
Susebinutilslinux enterprise high performance computing 15 sp1-ltss2.37-7.26.1fixed
Susebinutilslinux enterprise server 15 sp1-bcl2.37-7.26.1fixed
Susebinutilslinux enterprise server 15 sp1-ltss2.37-7.26.1fixed
Susebinutilslinux enterprise server for sap applications 15 sp12.37-7.26.1fixed
Susebinutilsenterprise storage 62.37-7.26.1fixed
Opensusebinutilsleap 15.32.37-7.26.1fixed
Opensusecross-aarch64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-arm-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-avr-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-epiphany-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-hppa-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-hppa64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-i386-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-ia64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-m68k-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-mips-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-ppc-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-ppc64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-ppc64le-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-riscv64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-rx-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-s390-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-s390x-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-sparc-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-sparc64-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-spu-binutilsleap 15.32.37-7.26.1fixed
Opensusecross-x86_64-binutilsleap 15.32.37-7.26.1fixed
Susebinutilshpe helion openstack 82.37-9.44.1fixed
Susebinutilsopenstack cloud 82.37-9.44.1fixed
Susebinutilsopenstack cloud 92.37-9.44.1fixed
Susebinutilsopenstack cloud crowbar 82.37-9.44.1fixed
Susebinutilsopenstack cloud crowbar 92.37-9.44.1fixed
Susebinutilslinux enterprise server for sap applications 12 sp32.37-9.44.1fixed
Susebinutilslinux enterprise server for sap applications 12 sp42.37-9.44.1fixed
Susebinutilslinux enterprise software development kit 12 sp52.37-9.44.1fixed
Susecross-ppc-binutilslinux enterprise software development kit 12 sp52.37-9.44.1fixed
Susecross-spu-binutilslinux enterprise software development kit 12 sp52.37-9.44.1fixed
Susebinutilslinux enterprise server 12 sp2-bcl2.37-9.44.1fixed
Susebinutilslinux enterprise server 12 sp3-ltss2.37-9.44.1fixed
Susebinutilslinux enterprise server 12 sp3-bcl2.37-9.44.1fixed
Susebinutilslinux enterprise server 12 sp4-ltss2.37-9.44.1fixed
Susebinutilslinux enterprise server 12 sp52.37-9.44.1fixed
Susebinutilslinux enterprise server for sap applications 12 sp52.37-9.44.1fixed
Opensusebinutilstumbleweed2.37-3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbinutilssourcesid2.35.2-1unimportantNot reportedNot reported
Debianbinutilssourceforky2.35.2-1unimportantNot reportedNot reported
Debianbinutilssourcetrixie2.35.2-1unimportantNot reportedNot reported
Debianbinutilssourcebookworm2.35.2-1unimportantNot reportedNot reported
Susebinutilsrpmlinux enterprise module for basesystem 15 sp22.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise module for basesystem 15 sp32.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise module for development tools 15 sp22.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise module for development tools 15 sp32.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise module for package hub 15 sp22.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise module for package hub 15 sp32.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise high performance computing 15 sp1-espos2.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise high performance computing 15 sp1-ltss2.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise server 15 sp1-bcl2.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise server 15 sp1-ltss2.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmlinux enterprise server for sap applications 15 sp12.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmenterprise storage 62.37-7.26.1Not reportedSUSE-SU-2021:3643-1Not reported
Opensusebinutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-aarch64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-arm-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-avr-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-epiphany-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-hppa-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-hppa64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-i386-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-ia64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-m68k-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-mips-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-ppc-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-ppc64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-ppc64le-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-riscv64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-rx-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-s390-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-s390x-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-sparc-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-sparc64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-spu-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Opensusecross-x86_64-binutilsrpmleap 15.32.37-7.26.1Not reportedOPENSUSE-SU-2021:3643-1Not reported
Susebinutilsrpmhpe helion openstack 82.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmopenstack cloud 82.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmopenstack cloud 92.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmopenstack cloud crowbar 82.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmopenstack cloud crowbar 92.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server for sap applications 12 sp32.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server for sap applications 12 sp42.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise software development kit 12 sp52.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susecross-ppc-binutilsrpmlinux enterprise software development kit 12 sp52.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susecross-spu-binutilsrpmlinux enterprise software development kit 12 sp52.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server 12 sp2-bcl2.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server 12 sp3-ltss2.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server 12 sp3-bcl2.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server 12 sp4-ltss2.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server 12 sp52.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Susebinutilsrpmlinux enterprise server for sap applications 12 sp52.37-9.44.1Not reportedSUSE-SU-2021:3637-1Not reported
Opensusebinutilsrpmtumbleweed2.37-3.1Not reportedOPENSUSE-SU-2024:11634-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [binutils-devel]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

  • [binutils-devel-32bit]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

  • [gprofng]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

  • [libctf0]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

  • [libctf-nobfd0]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

  • [libsframe2]Unknown

    Source package: [binutils]

    Details (1)

    • 2.45-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.37-3.1

      Version impact unknown

      dsa · binutils · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [binutils]Fixed
    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-aarch64-linux-gnu]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-aarch64-linux-gnu-dbg]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-alpha-linux-gnu]Fixed

    Source package: [binutils]

    Details (1)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-alpha-linux-gnu-dbg]Fixed

    Source package: [binutils]

    Details (1)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arc-linux-gnu]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arc-linux-gnu-dbg]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arm-linux-gnueabi]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arm-linux-gnueabi-dbg]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arm-linux-gnueabihf]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-arm-linux-gnueabihf-dbg]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-common]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-dev]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · amd64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · arm64 · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

  • [binutils-doc]Fixed

    Source package: [binutils]

    Details (2)

    • 2.40-2 · all · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

    • 2.40-2 · all · bookworm

      Fixed · Fixed: 2.35.2-1

      dsa · binutils · debian · bookworm; dsa · binutils · debian · 12

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]