CVE-2016-4487: Use After Free

Published Feb 24, 2017

Updated

Last updated 24 July 2024

Other sources

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."

Affected Software

4 affected componentsFixes available

GNU Libiberty

debian/binutils

2.35.2-22.40-22.44-3

debian/ht

2.1.0+repack1-5

debian/libiberty

20210106-120230104-120250315-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/binutils to a version that resolves this vulnerability.
Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Upgrade
Upgrade debian/ht to a version that resolves this vulnerability.
Fixed in 2.1.0+repack1-5
Upgrade
Upgrade debian/libiberty to a version that resolves this vulnerability.
Fixed in 20210106-1Fixed in 20230104-1Fixed in 20250315-1

Event History

Feb 24, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Data Sourced

via NVD·08:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2016-4487?

CVE-2016-4487 is a use-after-free vulnerability in libiberty that allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.

Which software is affected by CVE-2016-4487?

The affected software includes binutils, libiberty, valgrind, and gdb.

How can the use-after-free vulnerability in libiberty be exploited?

The vulnerability can be exploited by remote attackers using a crafted binary.

What is the severity of CVE-2016-4487?

The severity of CVE-2016-4487 is high as it can lead to a denial of service.

Is there a fix available for CVE-2016-4487?

Yes, the recommended fix is to update the affected software to the specified versions.