CVE-2017-14939

decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.

• CWE-125

• http://www.securityfocus.com/bid/101216
• https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read_1_byte-dwarf2-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22169Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=515f23e63c0074ab531bc954f84ca40c6281a724
• https://www.exploit-db.com/exploits/42970/
• http://www.securityfocus.com/bid/101216
• https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read_1_byte-dwarf2-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22169Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=515f23e63c0074ab531bc954f84ca40c6281a724
• https://www.exploit-db.com/exploits/42970/

Published

Sep 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14932decode_line_info in dwarf2.c in the Binary File Descriptor (…
• CVE-2017-14933read_formatted_entries in dwarf2.c in the Binary File Descri…
• CVE-2017-14934process_debug_info in dwarf.c in the Binary File Descriptor …
• CVE-2017-14935Pulse Secure Pulse One On-Premise 2.0.1649 and below does no…
• CVE-2017-14937The airbag detonation algorithm allows injury to passenger-c…
• CVE-2017-14938_bfd_elf_slurp_version_tables in elf.c in the Binary File De…
• CVE-2017-1494IBM Business Process Manager 8.5 is vulnerable to cross-site…
• CVE-2017-14940scan_unit_for_symbols in dwarf2.c in the Binary File Descrip…
• CVE-2017-14941Jaspersoft JasperReports 4.7 suffers from a saved credential…
• CVE-2017-14942Intelbras WRN 150 devices allow remote attackers to read the…
• CVE-2017-14943Trapeze TransitMaster is vulnerable to information disclosur…
• CVE-2017-14944Inedo ProGet before 4.7.14 does not properly address dangero…