CVE-2017-14745: Integer Overflow

Published Sep 26, 2017

Updated

The getsyntheticsymtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Affected Software

1 affected component

GNU binutils=2.29

Remediation

Patch Available

https://sourceware.org/bugzilla/show_bug.cgi?id=22148

Event History

Sep 26, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-14745?

CVE-2017-14745 has a severity rating that indicates it can lead to a denial of service via application crash.

How do I fix CVE-2017-14745?

To fix CVE-2017-14745, you should upgrade to a version of GNU Binutils that is later than 2.29.

What types of attacks can exploit CVE-2017-14745?

CVE-2017-14745 can be exploited by remote attackers to cause denial of service through an integer overflow.

In which software is CVE-2017-14745 found?

CVE-2017-14745 is found in GNU Binutils version 2.29.

What functions are impacted by CVE-2017-14745?

The *_get_synthetic_symtab functions in the BFD library are impacted by CVE-2017-14745.