CVE-2017-15020: High severity GNU binutils vulnerability
dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parsedie and parselinetable, as demonstrated by a parsedie heap-based buffer over-read.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15020?
CVE-2017-15020 is a vulnerability in the Binary File Descriptor (BFD) library in GNU Binutils 2.29, which can be exploited via a crafted ELF file to cause a denial of service or unspecified impact.
How does CVE-2017-15020 affect binutils?
CVE-2017-15020 affects binutils versions 2.29 and possibly other versions, and can lead to a denial of service or other impact.
How can I fix CVE-2017-15020?
To fix CVE-2017-15020, update binutils to version 2.29.90.20180122-1 or apply the appropriate remedy provided by your distribution.
Where can I find more information about CVE-2017-15020?
You can find more information about CVE-2017-15020 on the references provided: [Link1](https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/), [Link2](https://sourceware.org/bugzilla/show_bug.cgi?id=22202), [Link3](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5).