GNU Binutils CVE-2017-9955 Multiple Heap Based Buffer Overflow Vulnerabilities

Bugtraq ID:	99573
Class:	Boundary Condition Error
CVE:	CVE-2017-9955
Remote:	Yes
Local:	No
Published:	Jul 13 2017 12:00AM
Updated:	Jul 13 2017 12:00AM
Credit:	Initial analysis.
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 GNU Binutils 2.28
Not Vulnerable:

GNU Binutils CVE-2017-9955 Multiple Heap Based Buffer Overflow Vulnerabilities

GNU Binutils is prone to multiple heap based buffer overflow vulnerabilities.

An attacker can exploit these issues to crash the affected application, resulting in denial-of-service conditions. Due to the nature of these issues, arbitrary code execution may be possible but this has not been confirmed.

GNU Binutils 2.28 is vulnerable; other versions may also be affected.

GNU Binutils CVE-2017-9955 Multiple Heap Based Buffer Overflow Vulnerabilities

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

GNU Binutils CVE-2017-9955 Multiple Heap Based Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNU Binutils CVE-2017-9955 Multiple Heap Based Buffer Overflow Vulnerabilities

References:

• CVE-2017-9955 (Redhat)
  
• binutils Homepage (binutils)
  
• Bug 1469748 - (CVE-2017-9955) CVE-2017-9955 binutils: heap buffer over-read in (Redhat)
  
• Bug 21665 - Multiple heap based buffer overflow in the objdump tool of the GNU (sourceware.org)