CVE-2017-16831

HIGH

GNU Binutils - Integer Overflow in BFD Library via Crafted PE File

Title source: llm
STIX 2.1

Description

coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201811-17
Exploit, Issue Tracking, Patch x_refsource_confirm
https://sourceware.org/bugzilla/show_bug.cgi?id=22385

Scores

CVSS v3 7.8
EPSS 0.0034
EPSS Percentile 56.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (1)
gnu/binutils 2.29.1
Published Nov 15, 2017
Tracked Since Feb 18, 2026