The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade binutils | Jul 30, 2024 | May 1, 2017 |
| Gentoo Linux | — | Upgrade sys-devel/binutils. | Oct 30, 2017 | May 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade binutils-develUpgrade binutils | Dec 4, 2019 | May 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade binutilsUpgrade binutils-devel | Dec 18, 2019 | May 1, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade binutils-develUpgrade binutils | Nov 19, 2019 | May 1, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 22, 2017 |
| Suse | — | Upgrade cross-spu-binutilsUpgrade cross-ppc-binutilsUpgrade libctf-nobfd0Upgrade binutils-develUpgrade binutils-goldUpgrade libctf0Upgrade binutils-devel-32bitUpgrade binutils | Dec 1, 2017 | May 1, 2017 |
| Ubuntu | — | Upgrade binutils (Ubuntu Pro)Upgrade binutils-multiarch (Ubuntu Pro) | Jul 22, 2021 | May 1, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub