CVE-2017-16831
HighSummary
The Binary File Descriptor (BFD) library in GNU Binutils version 2.29.1 has a vulnerability that does not validate the symbol count. This can lead to denial of service through integer overflow and application crash or excessive memory allocation.
Risk Assessment
Remote attackers may exploit this vulnerability to cause application crashes, leading to service availability interruptions. There is also a risk of unspecified impact on the system.
Recommendation
It is recommended to update to the latest version of GNU Binutils to mitigate this vulnerability. Additionally, monitor and restrict access to systems that may be vulnerable to attacks exploiting this issue.
Other vulnerabilities in Binary File Descriptor (BFD) library in GNU Binutils
See all- CVE-2017-16826High
The coff_slurp_line_table function in the Binary File Descriptor (BFD) library in version 2.29.1 of GNU Binutils allows remote attackers to cause a denial of service through a crafted PE file, leading to invalid memory access and application crash.
- CVE-2017-12455High
The evax_bfd_print_emh function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
- CVE-2017-7614Critical
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.
Original NVD description (English source)
coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.