PT-2017-4309 · Gnu+1 · Gnu Binutils+1

Published 2017-09-26 · Updated 2021-07-21 · CVE-2017-15225

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to a memory leak caused by the bfd dwarf2 cleanup debug info function in the dwarf2.c component of the Binary File Descriptor (BFD) library, also known as libbfd. This allows remote attackers to cause a denial of service via a crafted ELF file. The vulnerability is associated with the non-release of resources after their expiration, which can be exploited by an attacker to disrupt service.

Recommendations: For GNU Binutils version 2.29, consider updating to a newer version that contains a fix for this issue, as the current version is affected by a memory leak in the bfd dwarf2 cleanup debug info function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

BDU:2023-07764

CVE-2017-15225

USN-4336-2

Affected Products

Gnu Binutils

Ubuntu

References · 456

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14940 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7209 · Security Note