CVE-2017-15020: dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to…

high7.8CVSS 3.0

AVLACLPRNUIRSUCHIHAH

dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	binutils	< binutils 2.29.90.20180122-1 (bookworm)	binutils 2.29.90.20180122-1 (bookworm)
gnu	binutils	—	—
gnu	binutils	>= 0 < 2.29.90.20180122-1	2.29.90.20180122-1
gnu	binutils	>= 0 < 2.29.90.20180122-1	2.29.90.20180122-1
gnu	binutils	>= 0 < 2.29.90.20180122-1	2.29.90.20180122-1
gnu	binutils	>= 0 < 2.29.90.20180122-1	2.29.90.20180122-1

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

osv7.8HIGH