CVE-2017-14529: Medium severity GNU binutils vulnerability

Published Sep 18, 2017

Updated

Last updated 24 July 2024

Other sources

The peprintidata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfdgetl16 function.

Affected Software

2 affected componentsFixes available

GNU binutils=2.29

debian/binutils

2.35.2-22.40-22.44-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/binutils to a version that resolves this vulnerability.
Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3

Event History

Sep 18, 2017

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is CVE-2017-14529?

CVE-2017-14529 is a vulnerability in the Binary File Descriptor (BFD) library (libbfd) in GNU Binutils 2.29 that allows remote attackers to cause a denial of service.

How does CVE-2017-14529 impact the affected software?

CVE-2017-14529 can cause a denial of service (heap-based buffer over-read and application crash) in the affected software.