CVE-2017-12799 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Binutils

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-502 — Deserialization of Untrusted Data12 documents10 sources

Severity

7.8HIGHNVD

GHSA6.5

EPSS

0.3%

top 47.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

GNU Binutils

Timeline

PublishedAug 10

Latest updateMay 24

Description

The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debiangnu/binutils< 2.29-9+3

▶NVDgnu/binutils2.29

Patches

Patch: sourceware.org ↗Patch: sourceware.org ↗

🔴Vulnerability Details

GHSA

Shopware Insecure Deserialization Vulnerability↗2022-05-24

▶

GHSA

GHSA-c5xx-5q9j-76qv: The elf_read_notesfunction in bfd/elf↗2022-05-14

▶

OSV

CVE-2017-12799: The elf_read_notesfunction in bfd/elf↗2017-08-10

▶

CVEList

CVE-2017-12799: The elf_read_notesfunction in bfd/elf↗2017-08-10

▶

📋Vendor Advisories

Ubuntu

GNU binutils vulnerabilities↗2021-07-21

▶

Red Hat

binutils: Heap-based 1 byte buffer over-write in elf_read_notes function in bfd/elf.c↗2017-08-10

▶

Debian

CVE-2017-12799: binutils - The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attac...↗2017

▶

💬Community

HackerOne

Two vulnerability in GNU binutils↗2019-10-14

▶

Bugzilla

CVE-2017-12799 binutils: Heap-based 1 byte buffer over-write in elf_read_notes function in bfd/elf.c↗2017-08-10

▶

Bugzilla

CVE-2017-12799 mingw-binutils: binutils: Heap-based 1 byte buffer over-write in elf_read_notes function in bfd/elf.c [epel-all]↗2017-08-10

▶

Bugzilla

CVE-2017-12799 binutils: Heap-based 1 byte buffer over-write in elf_read_notes function in bfd/elf.c [fedora-all]↗2017-08-10

▶