CVE-2017-6966: Use After Free
Last updated 24 July 2024
Other sources
readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2017-6966?
CVE-2017-6966 is a use-after-free vulnerability in readelf in GNU Binutils 2.28.
How does CVE-2017-6966 affect the software?
CVE-2017-6966 affects GNU Binutils version 2.28-3 and potentially other versions as well.
What is the severity of CVE-2017-6966?
The severity of CVE-2017-6966 is not specified, but it is a use-after-free vulnerability which can potentially lead to arbitrary code execution.
How can I fix CVE-2017-6966?
To fix CVE-2017-6966, it is recommended to update to a version of GNU Binutils that includes the fix, such as version 2.28-3.
Where can I find more information about CVE-2017-6966?
More information about CVE-2017-6966 can be found at the following references: [1] https://sourceware.org/bugzilla/show_bug.cgi?id=21139 [2] https://security.gentoo.org/glsa/201709-02 [3] https://launchpad.net/bugs/cve/CVE-2017-6966