CVE-2017-14529 The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attacke...
MediumCVSS 5.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/binutils(Debian:12) | < 2.29-10 | 2.29-10 |
| debian/binutils(Debian:13) | < 2.29-10 | 2.29-10 |
| debian/binutils(Debian:14) | < 2.29-10 | 2.29-10 |
| GNU binutils | = 2.29 | No fix listed |
References
- Debian Security Tracker CVE-2017-14529 vendor-advisory
- sourceware.org issue-tracking patch third-party-advisory
- sourceware.org
- sourceware.org