REDHAT-BUG-1551771: Integer Overflow
First published: Mon Mar 05 2018(Updated: )
A flaw was found in the parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils up to version 2.30, when compiled in 32bit mode. This vulnerability allows attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupted dwarf1 debug information. References: <a href="https://sourceware.org/bugzilla/show_bug.cgi?id=22894">https://sourceware.org/bugzilla/show_bug.cgi?id=22894</a> Patch: <a href="https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eef104664efb52965d85a28bc3fc7c77e52e48e2">https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eef104664efb52965d85a28bc3fc7c77e52e48e2</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ubuntu/binutils | <2.30 | |
| GNU Binutils (libbfd) | <2.30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://sourceware.org/bugzilla/show_bug.cgi?id=22894
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eef104664efb52965d85a28bc3fc7c77e52e48e2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1551772
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1551774
- https://access.redhat.com/errata/RHSA-2018:3032
- https://bugzilla.redhat.com/show_bug.cgi?id=1551771
Frequently Asked Questions
What is the severity of REDHAT-BUG-1551771?
REDHAT-BUG-1551771 has a severity that can lead to denial of service due to an integer overflow and application crash.
How do I fix REDHAT-BUG-1551771?
To fix REDHAT-BUG-1551771, upgrade to a version of GNU Binutils greater than 2.30.
Which software is affected by REDHAT-BUG-1551771?
REDHAT-BUG-1551771 affects GNU Binutils up to version 2.30 and the BFD library (libbfd) in the same version range.
What causes the vulnerability in REDHAT-BUG-1551771?
The vulnerability in REDHAT-BUG-1551771 is caused by a flaw in the parse_die function within the BFD library when running in 32-bit mode.
Is REDHAT-BUG-1551771 a remote exploitation risk?
REDHAT-BUG-1551771 does not pose a direct remote exploitation risk as it primarily leads to a local denial of service.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-7568
- agent/source
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/ubuntu/binutils
- canonical/gnu binutils (libbfd)