Heap-Based Buffer Over-Read Vulnerability in Binutils - CVE-2017-14939
Summary
UBUNTU-CVE-2017-14939: decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (hea... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Binutils is a collection of binary tools that are essential for the development and management of software applications. It includes tools for assembling, linking, and manipulating binary files, making it a critical component for developers working with various programming languages. The package is widely used in Unix-like operating systems, including Ubuntu. This vulnerability affects specific versions of Binutils, allowing attackers to exploit weaknesses in the library's handling of ELF files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14939, originates from a flaw in the decode_line_info function within the dwarf2.c file of the Binary File Descriptor (BFD) library, part of GNU Binutils version 2.29. This flaw mishandles length calculations, enabling remote attackers to cause a denial of service through a crafted ELF file. The exploitation can lead to heap-based buffer over-reads and application crashes, posing a significant risk to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted ELF files until the package is updated. This can help mitigate the risk of exploitation while waiting for a proper fix.
Conclusion
The CVE-2017-14939 vulnerability in Binutils poses a significant risk due to its potential to cause denial of service through crafted ELF files. Users are strongly advised to update their packages to the latest patched versions to ensure system security and stability.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-14939 is a vulnerability in the Binutils package that allows remote attackers to exploit a flaw in the handling of ELF files, leading to potential denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and denial of service, impacting system stability and security.
Yes, patched versions of Binutils are available for both Ubuntu 14.04 LTS and 16.04 LTS. Users should update to the specified versions to mitigate the risk.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
