CVE-2017-7614
CriticalSummary
The Binary File Descriptor (BFD) library in GNU Binutils 2.28 has an undefined behavior issue related to member access within a null pointer, which may lead to application crashes.
Risk Assessment
Remote attackers may cause denial of service by crashing the application, potentially affecting system availability.
Recommendation
It is recommended to upgrade to a newer version of GNU Binutils to mitigate this vulnerability.
Other vulnerabilities in Binary File Descriptor (BFD) library in GNU Binutils 2.28
See all- CVE-2017-16831High
The Binary File Descriptor (BFD) library in GNU Binutils version 2.29.1 has a vulnerability that does not validate the symbol count. This can lead to denial of service through integer overflow and application crash or excessive memory allocation.
- CVE-2017-16826High
The coff_slurp_line_table function in the Binary File Descriptor (BFD) library in version 2.29.1 of GNU Binutils allows remote attackers to cause a denial of service through a crafted PE file, leading to invalid memory access and application crash.
- CVE-2017-12455High
The evax_bfd_print_emh function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
Original NVD description (English source)
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.