PT-2017-17645 · Gnu+2 · Gnu Binutils+2

Marcel Böhme · Published 2017-03-29 · Updated 2024-06-15 · CVE-2017-7299

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28

Description The issue arises from an invalid read in the Binary File Descriptor (BFD) library, which is part of GNU Binutils. This occurs because the code responsible for emitting relocs does not verify the format of the input file before attempting to read the ELF reloc section header. As a result, the GNU linker (ld) program may crash.

Recommendations For GNU Binutils version 2.28, consider updating to a newer version that addresses this issue, as the current version may lead to a program crash due to the invalid read. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-7299

MGASA-2019-0169

OPENSUSE-SU-2018_3223-1

OPENSUSE-SU-2024:10651-1

SUSE-SU-2017:3170-1

SUSE-SU-2018:3207-1

SUSE-SU-2018:3207-2

USN-4336-2

Affected Products

Gnu Binutils

Suse

Ubuntu

References · 773

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10372 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8398 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7210 · Security Note