CVE-2017-12448: Use After Free
Last updated 24 July 2024
Other sources
The bfdcacheclose function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfdgenericarchivep function in bfd/archive.c.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-12448?
CVE-2017-12448 is a vulnerability in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.29 and earlier, which allows remote attackers to cause a heap use after free and possibly achieve code execution through a crafted nested archive file.
How does CVE-2017-12448 affect the affected software?
CVE-2017-12448 affects the Binutils package in Ubuntu versions 16.04.8+ (2.26.1-1ubuntu1~16.04.8+) and 18.04 (2.29.1).
What is the severity of CVE-2017-12448?
The severity of CVE-2017-12448 is high.
What is the Common Weakness Enumeration (CWE) for CVE-2017-12448?
The CWEs for CVE-2017-12448 are CWE-20 (Improper Input Validation) and CWE-416 (Use After Free).
How can I fix CVE-2017-12448?
To fix CVE-2017-12448, update the affected Binutils package to version 2.26.1-1ubuntu1~16.04.8+ (for Ubuntu 16.04.8+) or version 2.29.1 (for Ubuntu 18.04).