CVE-2017-15023 Null dereference in n/a
Remote attackers can cause a denial of service via a crafted ELF file due to a NULL pointer dereference in the BFD library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15023?
CVE-2017-15023 is a medium-severity vulnerability in Gnu Binutils, published on 4 Oct 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.
Weakness: CWE-476
Which versions are affected by CVE-2017-15023?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2017-15023?
Upgrade to a fixed version.
Is CVE-2017-15023 being exploited?
There is no known exploitation of CVE-2017-15023 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as DEBIAN-CVE-2017-15023, GHSA-v237-vcgw-685x.