PT-2017-18316 · Gnu+2 · Gnu Binutils+2

Manh-Dung Nguyen + 2 · Published 2017-05-01 · Updated 2021-07-21 · CVE-2017-8395

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28

Description The Binary File Descriptor (BFD) library is vulnerable due to a missing malloc() return-value check in the bfd generic get section contents function, causing an invalid write of size 8. This issue affects programs that analyze binary programs using the libbfd library, such as objcopy, leading to crashes.

Recommendations For GNU Binutils version 2.28, consider applying a patch that adds a malloc() return-value check to the bfd generic get section contents function to prevent invalid writes and subsequent crashes.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2017-8395

MGASA-2019-0169

SUSE-SU-2017:3170-1

USN-4336-2

Affected Products

Gnu Binutils

Suse

Ubuntu

References · 617

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10372 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8398 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7210 · Security Note