PT-2017-18328 · Gnu+2 · Gnu Binutils+2

Jgj212 · Published 2017-05-02 · Updated 2024-06-15 · CVE-2017-8421

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28

Description The issue is related to a memory leak in the coff set alignment hook function in the BFD library, which can lead to memory exhaustion when objdump processes a crafted PE file. Additional validation in the dump relocs in section function can help resolve this issue.

Recommendations For GNU Binutils version 2.28, consider adding additional validation in the dump relocs in section function in objdump.c to mitigate the memory leak issue. As a temporary workaround, restrict the use of objdump with crafted PE files until a patch is available.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2017-8421

MGASA-2019-0169

OPENSUSE-SU-2018_3223-1

OPENSUSE-SU-2024:10651-1

SUSE-SU-2017:3170-1

SUSE-SU-2018:3207-1

SUSE-SU-2018:3207-2

USN-4336-2

USN-6413-1

Affected Products

Gnu Binutils

Suse

Ubuntu

References · 803

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48063 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• https://bdu.fstec.ru/vul/2023-06831 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10372 · Security Note