CVE-2017-12449: High severity GNU binutils vulnerability
Last updated 24 July 2024
Other sources
The bfdvmssavesizedstring function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2017-12449?
CVE-2017-12449 is a vulnerability in the Binary File Descriptor (BFD) library, specifically in the _bfd_vms_save_sized_string function.
How does CVE-2017-12449 affect the affected software?
The affected software, specifically GNU Binutils version 2.29 and earlier, is vulnerable to remote attackers causing an out of bounds heap read via a crafted vms file.
What versions of the affected software are vulnerable to CVE-2017-12449?
CVE-2017-12449 affects GNU Binutils versions 2.29 and earlier.
What is the severity of CVE-2017-12449?
The severity of CVE-2017-12449 is not specified.
How can I fix CVE-2017-12449?
To fix CVE-2017-12449, upgrade to GNU Binutils version 2.29.1 or later.