PT-2017-18316 · Gnu+2 · Gnu Binutils+2

Manh-Dung Nguyen + 2 · Publicado 2017-05-01 · Atualizado 2021-07-21 · CVE-2017-8395

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28

Description The Binary File Descriptor (BFD) library is vulnerable due to a missing malloc() return-value check in the bfd generic get section contents function, causing an invalid write of size 8. This issue affects programs that analyze binary programs using the libbfd library, such as objcopy, leading to crashes.

Recommendations For GNU Binutils version 2.28, consider applying a patch that adds a malloc() return-value check to the bfd generic get section contents function to prevent invalid writes and subsequent crashes.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2017-8395

MGASA-2019-0169

SUSE-SU-2017:3170-1

USN-4336-2

Produtos afetados

Gnu Binutils

Suse

Ubuntu

Referências · 617

• https://suse.com/security/cve/CVE-2017-9756 · Nota
• https://ubuntu.com/security/CVE-2016-4492 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-4487 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17360 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00670 · Nota de Segurança
• https://sourceware.org/bugzilla/show_bug.cgi?id=24227 · Nota
• https://suse.com/security/cve/CVE-2017-12454 · Nota
• https://ubuntu.com/security/CVE-2017-14130 · Aviso do Fabricante
• https://bugzilla.suse.com/1030589 · Nota
• https://ubuntu.com/security/CVE-2017-9748 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-9043 · Nota
• https://bugzilla.suse.com/1031656 · Nota
• https://sourceware.org/bugzilla/show_bug.cgi?id=23806 · Nota
• https://ubuntu.com/security/CVE-2018-17985 · Aviso do Fabricante