Search for vulnerabilities
Vulnerability details: VCID-32gr-a4tq-vubt
Vulnerability ID VCID-32gr-a4tq-vubt
Aliases CVE-2018-18607
Summary An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
Status Published
Exploitability 0.5
Weighted Severity 5.0
Risk 2.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
cvssv3 3.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18607.json
epss 0.00678 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00678 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00704 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2018-18607
cvssv3 3.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2018-18607
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2018-18607
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18607.json
https://api.first.org/data/v1/epss?cve=CVE-2018-18607
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18607
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.netapp.com/advisory/ntap-20190307-0003/
https://sourceware.org/bugzilla/show_bug.cgi?id=23805
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=102def4da826b3d9e169741421e5e67e8731909a
http://www.securityfocus.com/bid/105754
1647421 https://bugzilla.redhat.com/show_bug.cgi?id=1647421
cpe:2.3:a:gnu:binutils:2.31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:binutils:2.31:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:*:*:*
CVE-2018-18607 https://nvd.nist.gov/vuln/detail/CVE-2018-18607
USN-4336-1 https://usn.ubuntu.com/4336-1/
USN-4336-2 https://usn.ubuntu.com/4336-2/
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18607.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18607
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18607
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.70676
EPSS Score 0.00678
Published At Sept. 23, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:37:42.599681+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/4336-1/ 37.0.0