CVE-2017-7303: High severity GNU binutils vulnerability

Published Mar 29, 2017

Updated

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the findlink function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.

Affected Software

1 affected component

GNU binutils=2.28

Remediation

Patch Available

https://sourceware.org/bugzilla/show_bug.cgi?id=20922

Event History

Mar 29, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-7303?

CVE-2017-7303 is classified as a medium severity vulnerability due to the potential for an invalid memory read.

How do I fix CVE-2017-7303?

To fix CVE-2017-7303, users should upgrade to a later version of GNU Binutils that addresses this issue.

What are the potential impacts of CVE-2017-7303?

The potential impacts of CVE-2017-7303 include crashes or unexpected behavior in utilities such as strip.

Which versions of GNU Binutils are affected by CVE-2017-7303?

CVE-2017-7303 specifically affects GNU Binutils version 2.28.

Is CVE-2017-7303 present in later versions of GNU Binutils?

CVE-2017-7303 is not present in GNU Binutils versions released after 2.28.