| Vulnerability Name: | CVE-2017-9749 (CCN-127548) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2017-06-13 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-06-13 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2018-01-09 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
5.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-9749 Source: CCN Type: IBM Security Bulletin 2012605 (PureData System for Analytics) Multiple vulnerabilities in Open Source Binutils and Open Source OpenSSL affect IBM Netezza Analytics Source: CCN Type: IBM Security Bulletin 2012609 (PureData System for Analytics) Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients. Source: BID Type: Third Party Advisory, VDB Entry 99113 Source: CCN Type: BID-99113 GNU Binutils CVE-2017-9749 Remote Denial of Service Vulnerability Source: XF Type: UNKNOWN gnu-binutils-cve20179749-dos(127548) Source: CCN Type: Packet Storm Security [06-20-2017] GNU binutils decode_pseudodbg_assert_0 Buffer Overflow Source: GENTOO Type: UNKNOWN GLSA-201801-01 Source: CCN Type: Sourceware Bugzilla Bug 21586 global-buffer-overflow in decode_pseudodbg_assert_0 Source: CONFIRM Type: Issue Tracking, Patch, Third Party Advisory https://sourceware.org/bugzilla/show_bug.cgi?id=21586 Source: CCN Type: Binutils GIT Repository Prevent invalid array accesses when disassembling a corrupt bfin binary Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [06-19-2017] Source: EXPLOIT-DB Type: UNKNOWN 42201 Source: CCN Type: WhiteSource Vulnerability Database CVE-2017-9749 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||