| Vulnerability Name: | CVE-2017-15023 (CCN-133223) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2017-10-04 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-10-04 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2018-01-09 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-476 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-15023 Source: BID Type: UNKNOWN 101611 Source: CCN Type: BID-101611 GNU Binutils CVE-2017-15023 Remote Denial of Service Vulnerability Source: CCN Type: agostino's blog, October 3, 2017 binutils: NULL pointer dereference in concat_filename (dwarf2.c) Source: MISC Type: Patch, Third Party Advisory, VDB Entry https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/ Source: XF Type: UNKNOWN gnu-binutils-cve201715023-dos(133223) Source: GENTOO Type: UNKNOWN GLSA-201801-01 Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://sourceware.org/bugzilla/show_bug.cgi?id=22200 Source: CCN Type: binutils-gdb.git Repository PR22200, DWARF5 .debug_line sanity check Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c361faae8d964db951b7100cada4dcdc983df1bf | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||