CVE-2017-14729

Name: CVE-2017-14729
Creator: NVD / NIST
Published: 2017-09-25T16:29:00.38+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.26%

Last modified Jun 17, 2026

CVE-2017-14729 is a vulnerability of currently unknown severity. The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.. EPSS estimates a 2.26% chance of exploitation in the next 30 days.

Description

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

Metrics

EPSS Probability

2.26%

80.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Gnu	Binutils	2.29

References

https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/Patch, Third Party Advisory, VDB Entry
https://sourceware.org/bugzilla/show_bug.cgi?id=22170Issue Tracking, Patch, Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=56933f9e3e90eebf1018ed7417d6c1184b91db6b
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360
https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/Patch, Third Party Advisory, VDB Entry
https://sourceware.org/bugzilla/show_bug.cgi?id=22170Issue Tracking, Patch, Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=56933f9e3e90eebf1018ed7417d6c1184b91db6b
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360

Timeline

Published: Sep 25, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-14729?

How severe is CVE-2017-14729?

Severity scoring for CVE-2017-14729 is pending analysis. The EPSS model estimates a 2.26% probability of exploitation in the next 30 days.

How do I fix CVE-2017-14729?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-14729?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST