CVE-2017-15020

dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.

• CWE-125

• https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22202Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5
• https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/Patch, Third Party Advisory, VDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=22202Issue Tracking, Patch, Third Party Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15015ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulne…
• CVE-2017-15016ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulne…
• CVE-2017-15017ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulne…
• CVE-2017-15018LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3…5.5
• CVE-2017-15019LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode…
• CVE-2017-1502IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vuln…
• CVE-2017-15021bfd_get_debug_link_info_1 in opncls.c in the Binary File Des…
• CVE-2017-15022dwarf2.c in the Binary File Descriptor (BFD) library (aka li…
• CVE-2017-15023read_formatted_entries in dwarf2.c in the Binary File Descri…
• CVE-2017-15024find_abstract_instance_name in dwarf2.c in the Binary File D…
• CVE-2017-15025decode_line_info in dwarf2.c in the Binary File Descriptor (…
• CVE-2017-15029Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected…