CVE-2017-14938

_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.

• CWE-770

• http://www.securityfocus.com/bid/101212Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2017/09/26/binutils-memory-allocation-failure-in-_bfd_elf_slurp_version_tables-elf-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22166Issue Tracking, Patch
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=bd61e135492ecf624880e6b78e5fcde3c9716df6
• http://www.securityfocus.com/bid/101212Third Party Advisory, VDB Entry
• https://blogs.gentoo.org/ago/2017/09/26/binutils-memory-allocation-failure-in-_bfd_elf_slurp_version_tables-elf-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22166Issue Tracking, Patch
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=bd61e135492ecf624880e6b78e5fcde3c9716df6

Published

Sep 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14931ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif …
• CVE-2017-14932decode_line_info in dwarf2.c in the Binary File Descriptor (…
• CVE-2017-14933read_formatted_entries in dwarf2.c in the Binary File Descri…
• CVE-2017-14934process_debug_info in dwarf.c in the Binary File Descriptor …
• CVE-2017-14935Pulse Secure Pulse One On-Premise 2.0.1649 and below does no…
• CVE-2017-14937The airbag detonation algorithm allows injury to passenger-c…
• CVE-2017-14939decode_line_info in dwarf2.c in the Binary File Descriptor (…
• CVE-2017-1494IBM Business Process Manager 8.5 is vulnerable to cross-site…
• CVE-2017-14940scan_unit_for_symbols in dwarf2.c in the Binary File Descrip…
• CVE-2017-14941Jaspersoft JasperReports 4.7 suffers from a saved credential…
• CVE-2017-14942Intelbras WRN 150 devices allow remote attackers to read the…
• CVE-2017-14943Trapeze TransitMaster is vulnerable to information disclosur…