PT-2017-4312 · Gnu+2 · Gnu Binutils+2

Published 2017-10-31 · Updated 2024-06-15 · CVE-2017-16826

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29.1

Description: The issue is related to a buffer overflow in the coff slurp line table function of the coffcode.h component in GNU Binutils. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service by using a specially crafted PE file. The exploitation can lead to invalid memory access and application crash.

Recommendations: For GNU Binutils version 2.29.1, consider disabling the coff slurp line table function as a temporary workaround until a patch is available. Restrict access to the coffcode.h component to minimize the risk of exploitation. Avoid using specially crafted PE files that could trigger the buffer overflow in the coff slurp line table function.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-07767

CVE-2017-16826

OPENSUSE-SU-2018_3223-1

OPENSUSE-SU-2018_3323-1

OPENSUSE-SU-2024:10651-1

SUSE-SU-2018:3170-1

SUSE-SU-2018:3207-1

SUSE-SU-2018:3207-2

USN-4336-2

Affected Products

Gnu Binutils

Suse

Ubuntu

References · 686

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=22376 · Exploit
• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10372 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8398 · Security Note