CVE-2017-13716: High severity GNU binutils vulnerability

Published Aug 28, 2017

Updated

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

Affected Software

1 affected component

GNU binutils=2.29

Remediation

Patch Available

https://sourceware.org/bugzilla/show_bug.cgi?id=22009

Event History

Aug 28, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-13716?

CVE-2017-13716 is classified as a denial of service vulnerability that can lead to application crashes.

How do I fix CVE-2017-13716?

To mitigate CVE-2017-13716, upgrade to a newer version of GNU Binutils that patches this vulnerability.

Who is affected by CVE-2017-13716?

CVE-2017-13716 affects users of GNU Binutils version 2.29.

What is the impact of CVE-2017-13716?

The impact of CVE-2017-13716 includes excessive memory allocation and potential crashes of applications using the affected library.

How does CVE-2017-13716 allow exploitation?

CVE-2017-13716 can be exploited through specially crafted files that trigger the vulnerability in the C++ symbol demangler routine.