CVE-2017-15938: Buffer Overflow
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DWFORMrefaddr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (findabstractinstancename invalid memory read, segmentation fault, and application crash).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15938?
CVE-2017-15938 is a vulnerability in the Binary File Descriptor (BFD) library, also known as libbfd, as distributed in GNU Binutils 2.29.
How does CVE-2017-15938 affect the Binutils package on Ubuntu?
The Binutils package version 2.29.90.20180122-1 on Ubuntu is affected by CVE-2017-15938.
How does CVE-2017-15938 affect the Binutils package on Debian?
The Binutils package versions 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5 on Debian are affected by CVE-2017-15938.
What is the impact of CVE-2017-15938?
CVE-2017-15938 allows remote attackers to cause a denial of service by exploiting a miscalculation in the DW_FORM_ref_addr die refs, resulting in an invalid memory read in find_abstract_instance_name.
How can I fix CVE-2017-15938 on Ubuntu?
To fix CVE-2017-15938 on Ubuntu, update the Binutils package to version 2.29.90.20180122-1 or higher.
How can I fix CVE-2017-15938 on Debian?
To fix CVE-2017-15938 on Debian, update the Binutils package to a version that has the remedy patch applied, such as versions 2.31.1-16, 2.35.2-2, 2.40-2, or 2.41-5.