Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2017-8421: GNU Binutils 2.28 may exhaust memory
CVE-2017-8421 · published 9 years ago
Summary
The objdump tool that ships with GNU Binutils version 2.28 can run out of memory when it processes a specially crafted Windows executable file. This can cause the program to stop working, potentially interrupting any scripts or services that rely on it. Upgrade to a newer Binutils release or apply the provided code update that adds extra checks to prevent the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gnu | binutils |
2.28 cpe:2.3:a:gnu:binutils:2.28:*:*:*:*:*:*:* |
Original advisory text
The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory ...
The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.
References
- https://security.gentoo.org/glsa/201709-02
- https://sourceware.org/bugzilla/show_bug.cgi?id=21440 Issue Tracking Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-772Missing Release of Resource after Effective Lifetime
Timeline
Published2 May 2017
Updated3 Nov 2026
First seen22 Aug 2026
Track software like this
Free during beta