CVE-2017-7614

Description

elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.

How to fix CVE-2017-7614

To remediate CVE-2017-7614, upgrade the affected package to a fixed version below.

• —upgrade to 2.28-r1 or later
• —upgrade to 2.28-4 or later

Is CVE-2017-7614 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.28-r1
• from 0, < 2.28-4

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-7614
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-7614