CVE-2017-15021: Medium severity GNU binutils vulnerability
bfdgetdebuglinkinfo1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfdgetl32.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15021?
CVE-2017-15021 is a vulnerability in the Binary File Descriptor (BFD) library, also known as libbfd.
What is the impact of CVE-2017-15021?
CVE-2017-15021 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) by exploiting a crafted ELF file.
Which software versions are affected by CVE-2017-15021?
CVE-2017-15021 affects GNU Binutils 2.29, Ubuntu binutils 2.29.90.20180122-1, and Ubuntu binutils 2.26.1-1ubuntu1~16.04.8+.
How can I fix CVE-2017-15021?
The recommended fix for CVE-2017-15021 is to upgrade to binutils version 2.29.90.20180122-1 (for Ubuntu) or a higher version that includes the patch.
Where can I find more information about CVE-2017-15021?
You can find more information about CVE-2017-15021 on the following sources: [Link 1](https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-bfd_getl32-opncls-c/), [Link 2](https://sourceware.org/bugzilla/show_bug.cgi?id=22197), [Link 3](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=52b36c51e5bf6d7600fdc6ba115b170b0e78e31d).