CVE-2017-8393: High severity GNU binutils vulnerability
Last updated 24 July 2024
Other sources
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHTREL/SHRRELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2017-8393?
CVE-2017-8393 is a vulnerability in the Binary File Descriptor (BFD) library (libbfd) as distributed in GNU Binutils 2.28.
How does CVE-2017-8393 affect software?
CVE-2017-8393 affects the binutils package versions 2.26.1-1ubuntu1~16.04.8+ and 2.28-5 on Ubuntu, and various versions on Debian.
What is the impact of CVE-2017-8393?
CVE-2017-8393 allows for a global buffer over-read error, potentially leading to a denial-of-service or information leakage.
How can I fix CVE-2017-8393 on Ubuntu?
To fix CVE-2017-8393 on Ubuntu, update the binutils package to version 2.26.1-1ubuntu1~16.04.8+.
How can I fix CVE-2017-8393 on Debian?
To fix CVE-2017-8393 on Debian, update the binutils package to one of the following versions: 2.31.1-16, 2.35.2-2, 2.40-2, or 2.41-5.