Skip to content
OpenAdvisories
Unscored CVE-2017-14729 EUVD-2017-6226GHSA-c2f6-rwr3-2vm4

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not …

Published Sep 25, 2017 · Updated Sep 17, 2024 · Assigned by mitre

Package: binutils Ecosystem: Debian

Description

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 binutils 2.29.1-2 —
Debian 13 binutils 2.29.1-2 —
Debian 12 binutils 2.29.1-2 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP3 binutils +2 2.29.1-9.20.2 SUSE-SU-2017:3170-1
SLES 12 SP2 binutils +2 2.29.1-9.20.2 SUSE-SU-2017:3170-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP3 binutils 2.29.1-9.20.2 SUSE-SU-2017:3170-1
SLES for SAP 12 SP2 binutils 2.29.1-9.20.2 SUSE-SU-2017:3170-1
SLES for SAP 12 SP1 binutils 2.29.1-9.20.2 SUSE-SU-2017:3170-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed binutils 2.37-1.3 openSUSE-SU-2024:10651-1

Advisories 2

References