CVE-2017-15023: Null Pointer Dereference
readformattedentries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concatfilename.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15023?
CVE-2017-15023 is classified as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2017-15023?
To fix CVE-2017-15023, upgrade to a version of GNU Binutils later than 2.29 that addresses this vulnerability.
What does CVE-2017-15023 affect?
CVE-2017-15023 affects GNU Binutils version 2.29 specifically through the read_formatted_entries function in the BFD library.
What type of attack is associated with CVE-2017-15023?
CVE-2017-15023 allows remote attackers to exploit the vulnerability leading to a denial of service through crafted ELF files.
Can CVE-2017-15023 be exploited locally?
CVE-2017-15023 primarily allows remote exploitation, making it more critical on systems processing untrusted ELF files.