CVE-2017-7226
Last modified
CVE-2017-7226 is a vulnerability of currently unknown severity. The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.. EPSS estimates a 2.46% chance of exploitation in the next 30 days.
Description
The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Binutils | 2.28 |
References
- https://sourceware.org/bugzilla/show_bug.cgi?id=20905Issue Tracking, Patch
- https://sourceware.org/bugzilla/show_bug.cgi?id=20905Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7226?
How severe is CVE-2017-7226?
How do I fix CVE-2017-7226?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7220OpenText Documentum Content Server allows superuser access v…
- CVE-2017-7221OpenText Documentum Content Server has an inadequate protect…
- CVE-2017-7222A cross-site scripting (XSS) vulnerability in MantisBT befor…
- CVE-2017-7223GNU assembler in GNU Binutils 2.28 is vulnerable to a global…
- CVE-2017-7224The find_nearest_line function in objdump in GNU Binutils 2.…
- CVE-2017-7225The find_nearest_line function in addr2line in GNU Binutils …
- CVE-2017-7227GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap…
- CVE-2017-7228An issue (known as XSA-212) was discovered in Xen, with fixe…
- CVE-2017-7229PGP/MIME encrypted messages injected into a Vaultive O365 (b…
- CVE-2017-7230A buffer overflow vulnerability in Disk Sorter Enterprise 9.…
- CVE-2017-7231pngdefry through 2017-03-22 is prone to a heap-based buffer-…
- CVE-2017-7233Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before…
Are you affected by CVE-2017-7226?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST