CVE-2018-17359: Buffer Overflow
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfdzalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2018-17359?
CVE-2018-17359 is a vulnerability in the Binary File Descriptor (BFD) library, also known as libbfd.
How does CVE-2018-17359 affect the affected software?
CVE-2018-17359 affects GNU Binutils version 2.31, specifically the Binary File Descriptor (BFD) library (libbfd).
What is the impact of CVE-2018-17359?
CVE-2018-17359 allows attackers to cause a denial of service (application crash) by exploiting an invalid memory access in bfd_zalloc in opncls.c.
How can I fix CVE-2018-17359?
To fix CVE-2018-17359, update to a version of binutils that includes the necessary fixes, such as version 2.30-21ubuntu1~18.04.3 for Ubuntu or versions 2.35.2-2, 2.40-2, or 2.41-5 for Debian.
Where can I find more information about CVE-2018-17359?
You can find more information about CVE-2018-17359 at the following references: [1] https://sourceware.org/bugzilla/show_bug.cgi?id=23686 [2] http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html [3] http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html