CVE-2017-15023: Null Pointer Dereference
First published: Thu Oct 05 2017(Updated: )
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ubuntu/binutils | =2.29 |
Remedy
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c361faae8d964db951b7100cada4dcdc983df1bf
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/101611
- https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/
- https://security.gentoo.org/glsa/201801-01
- https://sourceware.org/bugzilla/show_bug.cgi?id=22200
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c361faae8d964db951b7100cada4dcdc983df1bf
Frequently Asked Questions
What is the severity of CVE-2017-15023?
CVE-2017-15023 is classified as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2017-15023?
To fix CVE-2017-15023, upgrade to a version of GNU Binutils later than 2.29 that addresses this vulnerability.
What does CVE-2017-15023 affect?
CVE-2017-15023 affects GNU Binutils version 2.29 specifically through the read_formatted_entries function in the BFD library.
What type of attack is associated with CVE-2017-15023?
CVE-2017-15023 allows remote attackers to exploit the vulnerability leading to a denial of service through crafted ELF files.
Can CVE-2017-15023 be exploited locally?
CVE-2017-15023 primarily allows remote exploitation, making it more critical on systems processing untrusted ELF files.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/ubuntu/binutils
- version/ubuntu/binutils/2.29