CVE-2019-12972: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• GNU Binutils: version 2.32 only
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2019-06-26. Last modified 2026-10-08.