Mailinglist Archive: opensuse-bugs (4292 mails)

< Previous Next >
[Bug 1037273] New: VUL-0: CVE-2017-8421: binutils: libbfd: leak vulnerability in objdump via a crafted PE-file
  • From: bugzilla_noreply@xxxxxxxxxx
  • Date: Tue, 02 May 2017 18:43:53 +0000
  • Message-id: <bug-1037273-21960@http.bugzilla.opensuse.org/>
http://bugzilla.opensuse.org/show_bug.cgi?id=1037273


Bug ID: 1037273
Summary: VUL-0: CVE-2017-8421: binutils: libbfd: leak
vulnerability in objdump via a crafted PE-file
Classification: openSUSE
Product: openSUSE Distribution
Version: Leap 42.2
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Security
Assignee: security-team@xxxxxxx
Reporter: mikhail.kasimov@xxxxxxxxx
QA Contact: qa-bugs@xxxxxxx
Found By: ---
Blocker: ---

Created attachment 723532
--> http://bugzilla.opensuse.org/attachment.cgi?id=723532&action=edit
CVE-2017-8421_reproducer

Ref: https://nvd.nist.gov/vuln/detail/CVE-2017-8421
===================================================
Description

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor
(BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory
leak vulnerability which can cause memory exhaustion in objdump via a crafted
PE file. Additional validation in dump_relocs_in_section in objdump.c can
resolve this.
===================================================

Hyperlink

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=21440

[2]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=39ff1b79f687b65f4144ddb379f22587003443fb
(see https://sourceware.org/bugzilla/show_bug.cgi?id=21440#c2)

(open-)SUSE: https://software.opensuse.org/package/binutils

2.28 (TW, official repo)
2.26.1 (42.{1,2}, official repo)

--
You are receiving this mail because:
You are on the CC list for the bug.
< Previous Next >