CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2025-5244

A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.

Score
4.8 medium
Published
2025-05-27
Links
NVD · cve.org

Affected ports (19)

PortPackageVersionStatusMaintainer
devel/binutilsaarch64-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsaarch64-none-elf-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsamd64-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsarm-gnueabi-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsarm-none-eabi-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsavr-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsbinutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsi386-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsmingw32-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilspowerpc-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilspowerpc64-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilspowerpc64le-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsriscv32-unknown-elf-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsriscv64-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilsriscv64-none-elf-binutils2.44,1unaddressedcy@FreeBSD.org
devel/binutilss390x-binutils2.44,1unaddressedcy@FreeBSD.org
lang/gnatcross-binutils-aarch64gnatcross-binutils-aarch642.27_1unaddressedports@FreeBSD.org
lang/gnatdroid-binutilsgnatdroid-binutils2.27_1unaddressedjamie@catflap.org
lang/gnatdroid-binutils-x86gnatdroid-binutils-x862.27_1unaddressedports@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>aarch64-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>aarch64-none-elf-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>amd64-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>arm-gnueabi-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>arm-none-eabi-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>avr-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>i386-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>mingw32-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>powerpc-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>powerpc64-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>powerpc64le-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>riscv32-unknown-elf-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>riscv64-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>riscv64-none-elf-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>s390x-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>gnatcross-binutils-aarch64</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>gnatdroid-binutils</name>
	<range><lt>2.45</lt></range>
      </package>
      <package>
	<name>gnatdroid-binutils-x86</name>
	<range><lt>2.45</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability was found in GNU Binutils up to 2.44. It has been
	rated as critical. Affected by this issue is the function elf_gc_sweep
	of the file bfd/elflink.c of the component ld. The manipulation leads
	to memory corruption. An attack has to be approached locally. The
	exploit has been disclosed to the public and may be used. Upgrading to
	version 2.45 is able to address this issue. It is recommended to
	upgrade the affected component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-5244</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5244</url>
    </references>
    <dates>
      <discovery>2025-05-27</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>