CVE-2017-12455
HighSummary
The evax_bfd_print_emh function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
Risk Assessment
Attackers may exploit this vulnerability to read memory, potentially leading to the disclosure of sensitive information or system instability.
Recommendation
It is recommended to upgrade to a newer version of GNU Binutils to mitigate this vulnerability.
Other vulnerabilities in Binary File Descriptor (BFD) library in GNU Binutils
See all- CVE-2017-16831High
The Binary File Descriptor (BFD) library in GNU Binutils version 2.29.1 has a vulnerability that does not validate the symbol count. This can lead to denial of service through integer overflow and application crash or excessive memory allocation.
- CVE-2017-16826High
The coff_slurp_line_table function in the Binary File Descriptor (BFD) library in version 2.29.1 of GNU Binutils allows remote attackers to cause a denial of service through a crafted PE file, leading to invalid memory access and application crash.
- CVE-2017-7614Critical
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.
Original NVD description (English source)
The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.