CVE-2017-17122
published 2017-12-04CVE-2017-17122: The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to…
PriorityP434high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
1.88%
77.2th percentile
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | < binutils 2.29.90.20180122-1 (bookworm) | binutils 2.29.90.20180122-1 (bookworm) |
| gnu | binutils | — | — |
| gnu | binutils | >= 0 < 2.29.90.20180122-1 | 2.29.90.20180122-1 |
| gnu | binutils | >= 0 < 2.29.90.20180122-1 | 2.29.90.20180122-1 |
| gnu | binutils | >= 0 < 2.29.90.20180122-1 | 2.29.90.20180122-1 |
| gnu | binutils | >= 0 < 2.29.90.20180122-1 | 2.29.90.20180122-1 |
| gnu | binutils | >= 0 < 2.24-5ubuntu14.2+esm5 | 2.24-5ubuntu14.2+esm5 |
| gnu | binutils | >= 0 < 2.26.1-1ubuntu1~16.04.8+esm9 | 2.26.1-1ubuntu1~16.04.8+esm9 |
| gnu | binutils | >= 0 < 2.26.1-1ubuntu1~16.04.8+esm3 | 2.26.1-1ubuntu1~16.04.8+esm3 |
| gnu | binutils | >= 0 < 2.30-21ubuntu1~18.04.9+esm3 | 2.30-21ubuntu1~18.04.9+esm3 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU binutils vulnerabilities
vendor_ubuntu·2023-10-04·CVSS 7.8
CVE-2022-35205 [HIGH] GNU binutils vulnerabilities
Title: GNU binutils vulnerabilities
Summary: Several security issues were fixed in GNU binutils.
It was discovered that GNU binutils was not properly performing checks
when dealing with memory allocation operations, which could lead to
excessive memory consumption. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2017-17122, CVE-2017-8421)
It was discovered that GNU binutils was not properly performing bounds
checks when processing debug sections with objdump, which could lead to
an overflow. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu
14.04 LTS. (CVE-2018-20671, CVE-2018-6543)
It was discovered that GNU binutils contained a reacha
Ubuntu
GNU binutils vulnerabilities
vendor_ubuntu·2022-03-22·CVSS 7.8
CVE-2017-17122 [HIGH] GNU binutils vulnerabilities
Title: GNU binutils vulnerabilities
Summary: Several security issues were fixed in GNU binutils.
It was discovered that GNU binutils incorrectly handled checks for memory
allocation when parsing relocs in a corrupt file. An attacker could possibly
use this issue to cause a denial of service. (CVE-2017-17122)
It was discovered that GNU binutils incorrectly handled certain corrupt DWARF
debug sections. An attacker could possibly use this issue to cause GNU
binutils to consume memory, resulting in a denial of service. (CVE-2021-3487)
It was discovered that GNU binutils incorrectly performed bounds checking
operations when parsing stabs debugging information. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2021-45078)
Instructions: In
Red Hat
binutils: Excessive memory allocation in the dump_relocs_in_section function
vendor_redhat·2017-11-28·CVSS 7.8
CVE-2017-17122 [HIGH] CWE-400 binutils: Excessive memory allocation in the dump_relocs_in_section function
binutils: Excessive memory allocation in the dump_relocs_in_section function
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
Package: binutils (Red Hat Enterprise Linux 5) - Will not fix
Package: binutils220 (Red Hat Enterprise Linux 5) - Will not fix
Package: binutils (Red Hat Enterprise Linux 6) - Will not fix
Package: binutils (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2017-17122: binutils - The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not...
vendor_debian·2017·CVSS 7.8
CVE-2017-17122 [HIGH] CVE-2017-17122: binutils - The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not...
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
Scope: local
bookworm: resolved (fixed in 2.29.90.20180122-1)
bullseye: resolved (fixed in 2.29.90.20180122-1)
forky: resolved (fixed in 2.29.90.20180122-1)
sid: resolved (fixed in 2.29.90.20180122-1)
trixie: resolved (fixed in 2.29.90.20180122-1)
OSV
binutils vulnerabilities
osv·2023-10-04·CVSS 7.8
CVE-2017-17122 [HIGH] binutils vulnerabilities
binutils vulnerabilities
It was discovered that GNU binutils was not properly performing checks
when dealing with memory allocation operations, which could lead to
excessive memory consumption. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2017-17122, CVE-2017-8421)
It was discovered that GNU binutils was not properly performing bounds
checks when processing debug sections with objdump, which could lead to
an overflow. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu
14.04 LTS. (CVE-2018-20671, CVE-2018-6543)
It was discovered that GNU binutils contained a reachable assertion, which
could lead to an intentional assertion failure when
GHSA
GHSA-h2pc-rjq9-6889: The dump_relocs_in_section function in objdump
ghsa_unreviewed·2022-05-14
CVE-2017-17122 [HIGH] CWE-190 GHSA-h2pc-rjq9-6889: The dump_relocs_in_section function in objdump
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
OSV
binutils vulnerabilities
osv·2022-03-22·CVSS 7.8
CVE-2017-17122 [HIGH] binutils vulnerabilities
binutils vulnerabilities
It was discovered that GNU binutils incorrectly handled checks for memory
allocation when parsing relocs in a corrupt file. An attacker could possibly
use this issue to cause a denial of service. (CVE-2017-17122)
It was discovered that GNU binutils incorrectly handled certain corrupt DWARF
debug sections. An attacker could possibly use this issue to cause GNU
binutils to consume memory, resulting in a denial of service. (CVE-2021-3487)
It was discovered that GNU binutils incorrectly performed bounds checking
operations when parsing stabs debugging information. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2021-45078)
OSV
CVE-2017-17122: The dump_relocs_in_section function in objdump
osv·2017-12-04·CVSS 7.8
CVE-2017-17122 [HIGH] CVE-2017-17122: The dump_relocs_in_section function in objdump
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-17122 binutils: Excessive memory allocation in the dump_relocs_in_section function
bugzilla·2017-12-11·CVSS 7.8
CVE-2017-17122 [HIGH] CVE-2017-17122 binutils: Excessive memory allocation in the dump_relocs_in_section function
CVE-2017-17122 binutils: Excessive memory allocation in the dump_relocs_in_section function
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.
Upstream issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=22508
Upstream patches:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d785b7d4b877ed465d04072e17ca19d0f47d840f
Discussion:
Created binutils tracking bugs for this issue:
Affects: fedora-all [bug 1499311]
Created mingw-binutils tracking bugs for this issue:
Affects: epel-all [bug 1499310]
Bugzilla
CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2
bugzilla·2017-10-06·CVSS 5.5
CVE-2017-14529 [MEDIUM] CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2
CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2017-15022 ... binutils: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the releva
Bugzilla
CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2
bugzilla·2017-10-06·CVSS 5.5
CVE-2017-14529 [MEDIUM] CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2
CVE-2017-14529 CVE-2017-14729 CVE-2017-14745 CVE-2017-14930 CVE-2017-14932 CVE-2017-14933 CVE-2017-14934 CVE-2017-14938 CVE-2017-14939 CVE-2017-14940 CVE-2017-14974 CVE-2017-15020 CVE-2017-15021 CVE-2017-15022 ... mingw-binutils: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the rele
arXiv
Detecting Code Vulnerabilities with Heterogeneous GNN Training
arxiv_fulltext·2025-02-24
Detecting Code Vulnerabilities with Heterogeneous GNN Training
Detecting Code Vulnerabilities with Heterogeneous GNN Training
Yu Luo, Weifeng Xu, Dianxiang Xu
...
Manuscript received April XX, 2023; revised XX XX, 202X.
Journal of \ Class Files, Vol. 14, No. 8, August 2021
Shell et al.: A Sample Article Using IEEEtran.cls for IEEE Journals
## Abstract
Detecting vulnerabilities in source code is a critical task for software security assurance. Graph Neural Network (GNN) machine learning can be a promising approach by modeling source code as graphs. Early approaches treated code elements uniformly, limiting their capacity to model diverse relationships that contribute to various vulnerabilities. Recent research addresses this limitation by considering the heterogeneity of node types and using Gated Graph Neural Networks (GGNN) to aggregate node inf
https://security.gentoo.org/glsa/201811-17https://sourceware.org/bugzilla/show_bug.cgi?id=22508https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d785b7d4b877ed465d04072e17ca19d0f47d840fhttps://security.gentoo.org/glsa/201811-17https://sourceware.org/bugzilla/show_bug.cgi?id=22508https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d785b7d4b877ed465d04072e17ca19d0f47d840f
2017-12-04
Published