CVE-2017-12449: High severity binutils vulnerability
Published Aug 4, 2017
·Updated
Last updated 24 July 2024
Other sources
The bfdvmssavesizedstring function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.
Affected Software
2 affected componentsFixes available
GNU binutils<=2.29
debian/binutils
2.35.2-22.40-22.44-3
Remediation
Patch Available
Event History
Aug 4, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:26 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·01:18 AM
RemedyDescriptionSeverityAffected Software
Feb 27, 2025
Data Sourced
via Debian·03:35 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2017-12449?
CVE-2017-12449 is a vulnerability in the Binary File Descriptor (BFD) library, specifically in the _bfd_vms_save_sized_string function.
2
How does CVE-2017-12449 affect the affected software?
The affected software, specifically GNU Binutils version 2.29 and earlier, is vulnerable to remote attackers causing an out of bounds heap read via a crafted vms file.
3
What versions of the affected software are vulnerable to CVE-2017-12449?
CVE-2017-12449 affects GNU Binutils versions 2.29 and earlier.
4
What is the severity of CVE-2017-12449?
The severity of CVE-2017-12449 is not specified.
5
How can I fix CVE-2017-12449?
To fix CVE-2017-12449, upgrade to GNU Binutils version 2.29.1 or later.