CVE-2017-8393: High severity binutils vulnerability
Last updated 24 July 2024
Other sources
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHTREL/SHRRELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-8393?
CVE-2017-8393 is a vulnerability in the Binary File Descriptor (BFD) library (libbfd) as distributed in GNU Binutils 2.28.
How does CVE-2017-8393 affect software?
CVE-2017-8393 affects the binutils package versions 2.26.1-1ubuntu1~16.04.8+ and 2.28-5 on Ubuntu, and various versions on Debian.
What is the impact of CVE-2017-8393?
CVE-2017-8393 allows for a global buffer over-read error, potentially leading to a denial-of-service or information leakage.
How can I fix CVE-2017-8393 on Ubuntu?
To fix CVE-2017-8393 on Ubuntu, update the binutils package to version 2.26.1-1ubuntu1~16.04.8+.
How can I fix CVE-2017-8393 on Debian?
To fix CVE-2017-8393 on Debian, update the binutils package to one of the following versions: 2.31.1-16, 2.35.2-2, 2.40-2, or 2.41-5.