{ "document": { "aggregate_severity": { "text": "Low" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/vex/2025/cve-2025-1152-els_os-rhel7els.json" } ], "tracking": { "current_release_date": "2026-07-28T15:52:14Z", "generator": { "date": "2026-07-28T15:52:14Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-1152-ELS_OS-RHEL7ELS", "initial_release_date": "2025-02-10T18:15:00Z", "revision_history": [ { "date": "2025-02-10T18:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-07-28T15:52:14Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-1152" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils-devel@2.27-44.base.el7_9.1?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils@2.27-44.base.el7_9.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/binutils-devel@2.27-44.base.el7_9.1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els6?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_id": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils@2.27-44.base.el7_9.1.tuxcare.els6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els6?arch=i686" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product_id": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/binutils-devel@2.27-44.base.el7_9.1.tuxcare.els4?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686" }, "product_reference": "binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64" }, "product_reference": "binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-1152", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: \"I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master.\"", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-1152" }, { "category": "external", "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=15887", "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15887" }, { "category": "external", "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=32576", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32576" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.295056", "url": "https://vuldb.com/?ctiid.295056" }, { "category": "external", "summary": "https://vuldb.com/?id.295056", "url": "https://vuldb.com/?id.295056" }, { "category": "external", "summary": "https://www.gnu.org/", "url": "https://www.gnu.org/" } ], "release_date": "2025-02-10T18:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-07-28T12:00:55.962816Z", "details": "This vulnerability is a memory leak in GNU ld’s xstrdup that affects only the short‑lived linker process when processing inputs, with no confidentiality or integrity impact and at most a minor availability effect. ld runs only during build/link steps and is not a network‑facing service on production servers/VMs, so exploitation would require arranging for a build to link attacker‑controlled objects or linker scripts—an unusually high‑complexity scenario—making this CVE a low‑priority item in managed enterprise environments.", "product_ids": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-0:2.27-44.base.el7_9.1.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els2.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els4.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.i686", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.tuxcare.els6.x86_64", "Red-Hat-7:binutils-devel-0:2.27-44.base.el7_9.1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] } ] }