{ "document": { "aggregate_severity": { "text": "Low" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/vex/2025/cve-2025-1150-els_os-rhel7els.json" } ], "tracking": { "current_release_date": "2026-07-28T15:52:05Z", "generator": { "date": "2026-07-28T15:52:05Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-1150-ELS_OS-RHEL7ELS", "initial_release_date": "2025-02-10T17:15:00Z", "revision_history": [ { "date": "2025-02-10T17:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-07-28T15:52:05Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-1150" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils-devel@2.27-44.base.el7_9.1?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils@2.27-44.base.el7_9.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils-devel@2.27-44.base.el7_9.1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els6?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els6?arch=i686" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els4?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-1150", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-1150" }, { "category": "external", "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=15887", "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15887" }, { "category": "external", "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=32576", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32576" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.295054", "url": "https://vuldb.com/?ctiid.295054" }, { "category": "external", "summary": "https://vuldb.com/?id.295054", "url": "https://vuldb.com/?id.295054" }, { "category": "external", "summary": "https://www.gnu.org/", "url": "https://www.gnu.org/" } ], "release_date": "2025-02-10T17:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-07-28T12:01:28.318947Z", "details": "CVE-2025-1150 is a memory‑leak in the GNU ld linker’s libbfd (binutils 2.43) that requires a user to run ld on attacker‑crafted input; it has high attack complexity and no confidentiality or integrity impact. Despite the “Network” CVSS vector, ld is a build‑time, non‑network‑exposed tool, so exploitation in managed server/VM environments would hinge on deliberately ingesting untrusted object files and would only cause transient memory consumption within the ld process. Given its DoS‑only impact, required user interaction, and lack of privilege escalation or data exposure, it can be safely deprioritized for production systems.", "product_ids": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] } ] }