CVE-2017-15939: Null Pointer Dereference
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debugline file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concatfilename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15939?
CVE-2017-15939 is a vulnerability in the Binary File Descriptor (BFD) library, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.
How does CVE-2017-15939 impact Binutils?
CVE-2017-15939 impacts Binutils by mishandling NULL files in a .debug_line file table, leading to a vulnerability that can be exploited by remote attackers.
What is the severity of CVE-2017-15939?
The severity of CVE-2017-15939 is high.
What is the affected software?
The affected software is Binutils 2.26.1-1ubuntu1~16.04.8+, 2.29.90.20180122-1, 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5.
How can I fix CVE-2017-15939?
To fix CVE-2017-15939, you should update to the recommended versions of Binutils provided by the Ubuntu or Debian repositories.