What’s Vulnerable › Vulnerabilities

CVE-2017-17080

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-30 · updated 2026-06-17
• Weakness: CWE-125

Description

elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.

Affected products

• GNU Binutils: 2.29.1

References

• https://security.gentoo.org/glsa/201811-17
• https://sourceware.org/bugzilla/show_bug.cgi?id=22421
• https://security.gentoo.org/glsa/201811-17
• https://sourceware.org/bugzilla/show_bug.cgi?id=22421

Get alerted when CVE-2017-17080 or the next vulnerability affects your stack