CVE-2017-12967
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as...
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
CVE-2017-12967- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
CVE-2017-12967- Updated
- 2026-11-02
EUVDEUVD-2017-4488 No score
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
EUVD-2017-4488- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x93j-fm3w-m5v9
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as...
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
GHSA-x93j-fm3w-m5v9- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
CVE-2017-12967- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12967
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
DEBIAN-CVE-2017-12967- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12967
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.
- Record
UBUNTU-CVE-2017-12967- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2021-1635459139 No score
Fix CVE(s): CVE-2018-6323, CVE-2017-8421, CVE-2017-15024, CVE-2017-15025, CVE-2017-15022, CVE-2017-15020, CVE-2017-15021, CVE-2017-15225, CVE-2018-18483, CVE-2017-15996, CVE-2018-18484, CVE-2017-12799, CVE-2017-16831, CVE-2017-16832, CVE-2018-1000876, CVE-2018-7208, CVE-2019-14250, CVE-2017-12967, CVE-2019-9075, CVE-2017-17080, CVE-2019-9074, CVE-2018-17794, CVE-2017-17125, CVE-2017-17124, CVE-2017-17121, CVE-2017-6969, CVE-2017-17123, CVE-2018-17358, CVE-2017-6965, CVE-2017-6966, CVE-2018-12641, CVE-2018-8945, CVE-2017-7299, CVE-2018-12699, CVE-2018-10372, CVE-2018-10373, CVE-2019-17451, CVE-2019-17450, CVE-2018-18701, CVE-2018-18700, CVE-2017-7210, CVE-2018-20623, CVE-2017-15938, CVE-2017-15939, CVE-2017-9039, CVE-2017-9038, CVE-2017-14940, CVE-2018-17985, CVE-2018-12700, CVE-2017-9742, CVE-2017-9745, CVE-2017-9744, CVE-2017-9747, CVE-2017-7209, CVE-2017-9749, CVE-2017-9748, CVE-2018-9138, CVE-2017-16828, CVE-2017-16827, CVE-2017-16826, CVE-2017-7614, CVE-2018-6759, CVE-2016-4491, CVE-2017-9044, CVE-2017-9746, CVE-2017-9042, CVE-2017-9040, CVE-2017-9041, CVE-2017-9752, CVE-2017-9753, CVE-2017-9750, CVE-2017-9751, CVE-2017-9756, CVE-2016-4493, CVE-2017-9754, CVE-2017-9755, CVE-2016-4492, CVE-2018-19932, CVE-2017-12458, CVE-2017-12459, CVE-2018-18606, CVE-2018-18607, CVE-2018-18605, CVE-2017-12452, CVE-2017-12453, CVE-2017-12450, CVE-2017-12451, CVE-2017-12456, CVE-2016-4490, CVE-2017-12454, CVE-2017-12455, CVE-2019-14444, CVE-2016-2226, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2018-18309, CVE-2017-7223, CVE-2017-12449, CVE-2017-12448, CVE-2016-4488, CVE-2016-4489, CVE-2018-17359, CVE-2016-4487, CVE-2018-20671, CVE-2018-20002, CVE-2017-14128, CVE-2017-14129, CVE-2018-7568, CVE-2018-7569, CVE-2017-7302, CVE-2017-7301, CVE-2017-7300, CVE-2018-12934, CVE-2017-8394, CVE-2018-7643, CVE-2018-7642, CVE-2018-17360, CVE-2019-12972, CVE-2018-13033, CVE-2018-19931, CVE-2018-10534, CVE-2018-10535, CVE-2019-9077, CVE-2019-9071, CVE-2019-9070, CVE-2019-9073, CVE-2017-14333, CVE-2018-12698, CVE-2017-14130, CVE-2018-12697, CVE-2018-6543, CVE-2017-9954, CVE-2017-12457, CVE-2017-14939, CVE-2017-14938, CVE-2017-14932, CVE-2017-14930, CVE-2017-8398, CVE-2017-8393, CVE-2017-8395, CVE-2017-14529, CVE-2017-8397, CVE-2017-8396, CVE-2017-13710, CVE-2016-6131
- SECURITY UPDATE:
- CVE-*.patch: backported many upstream patches to fix security issues.
- CVE-2016-2226, CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131, CVE-2016-4491, CVE-2017-6965, CVE-2017-6966, CVE-2017-6969, CVE-2017-7209, CVE-2017-7210, CVE-2017-7223, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2017-7299, CVE-2017-7300, CVE-2017-7301, CVE-2017-7302, CVE-2017-7614, CVE-2017-8393, CVE-2017-8394, CVE-2017-8395, CVE-2017-8397, CVE-2017-8396, CVE-2017-8398, CVE-2017-8421, CVE-2017-9038, CVE-2017-9039, CVE-2017-9040, CVE-2017-9042, CVE-2017-9041, CVE-2017-9044, CVE-2017-9742, CVE-2017-9744, CVE-2017-9752, CVE-2017-9745, CVE-2017-9746, CVE-2017-9747, CVE-2017-9748, CVE-2017-9749, CVE-2017-9750, CVE-2017-9751, CVE-2017-9753, CVE-2017-9754, CVE-2017-9755, CVE-2017-9756, CVE-2017-9954, CVE-2017-12448, CVE-2017-12449, CVE-2017-12455, CVE-2017-12457, CVE-2017-12458, CVE-2017-12459, CVE-2017-12450, CVE-2017-12452, CVE-2017-12453, CVE-2017-12454, CVE-2017-12456, CVE-2017-14333, CVE-2017-12451, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710, CVE-2017-14128, CVE-2017-14129, CVE-2017-14130, CVE-2017-14529, CVE-2017-14930, CVE-2017-14932, CVE-2017-14938, CVE-2017-14939, CVE-2017-14940, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022, CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938, CVE-2017-15939, CVE-2017-15996, CVE-2017-16826, CVE-2017-16827, CVE-2017-16828, CVE-2017-16831, CVE-2017-16832, CVE-2017-17080, CVE-2017-17121, CVE-2017-17123, CVE-2017-17124, CVE-2018-6323, CVE-2018-6543, CVE-2018-6759, CVE-2018-7208, CVE-2018-7568, CVE-2018-7569, CVE-2018-7642, CVE-2018-7643, CVE-2018-8945, CVE-2018-13033, CVE-2018-9138, CVE-2018-12641, CVE-2018-12697, CVE-2018-12698, CVE-2018-12699, CVE-2018-12700, CVE-2018-17794, CVE-2018-17985, CVE-2018-18484, CVE-2018-18700, CVE-2018-18701, CVE-2018-10372, CVE-2018-10373, CVE-2018-10534, CVE-2018-10535, CVE-2018-12934, CVE-2018-18483, CVE-2018-17358, CVE-2018-17359, CVE-2018-17360, CVE-2018-18309, CVE-2018-18605, CVE-2018-18606, CVE-2018-18607, CVE-2018-19931, CVE-2018-19932, CVE-2018-20002, CVE-2018-20623, CVE-2018-20671, CVE-2018-1000876, CVE-2017-17125, CVE-2019-9073, CVE-2019-9074, CVE-2019-9075, CVE-2019-9077, CVE-2019-9070, CVE-2019-9071, CVE-2019-12972, CVE-2019-14250, CVE-2019-14444, CVE-2019-17450, CVE-2019-17451
- Record
CLSA-2021-1635459139- Updated
- 2026-11-02
OSVUSN-4336-2 No score
binutils vulnerabilities
USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-4336-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-aarch64-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-alpha-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-arm-linux-gnueabiTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-arm-linux-gnueabihfTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-devTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-docTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-hppa-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-hppa64-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-m68k-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
binutils-mips-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-mips64-linux-gnuabi64TuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-mips64el-linux-gnuabi64TuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-mipsel-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-multiarchTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-multiarch-devTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-powerpc-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-powerpc-linux-gnuspeTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-powerpc64-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-powerpc64le-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-s390x-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-sh4-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-sourceTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutils-sparc64-linux-gnuTuxCare:Ubuntu:16.04 |
before 2.26.1-1ubuntu1~16.04.10 | 2.26.1-1ubuntu1~16.04.10 |
binutilsDebian:12 |
before 2.29-5 | 2.29-5 |
binutilsDebian:13 |
before 2.29-5 | 2.29-5 |
binutilsDebian:14 |
before 2.29-5 | 2.29-5 |
binutilsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.23.52.20130913-0ubuntu12.23.90.20131017-1ubuntu12.23.90.20131116-1ubuntu12.23.91.20131123-1ubuntu12.24-1ubuntu1 Show 20 moreShow less2.24-1ubuntu22.24-2ubuntu12.24-2ubuntu22.24-2ubuntu32.24-4ubuntu12.24-5ubuntu12.24-5ubuntu22.24-5ubuntu32.24-5ubuntu3.12.24-5ubuntu132.24-5ubuntu142.24-5ubuntu14.12.24-5ubuntu14.22.24-5ubuntu14.2+esm12.24-5ubuntu14.2+esm22.24-5ubuntu14.2+esm32.24-5ubuntu14.2+esm52.24-5ubuntu14.2+esm62.24-5ubuntu14.2+esm72.24-5ubuntu14.2+esm8 |
None known |
binutilsUbuntu:Pro:16.04:LTS |
before 2.26.1-1ubuntu1~16.04.8+esm1, plus listed versions 2.25.1-6ubuntu12.25.51.20151022-0ubuntu22.25.51.20151022-0ubuntu32.25.51.20151027-0ubuntu12.25.51.20151028-0ubuntu1 Show 26 moreShow less2.25.51.20151106-0ubuntu12.25.51.20151113-1ubuntu12.25.51.20151113-2ubuntu12.25.90.20151125-1ubuntu12.25.90.20151125-2ubuntu12.25.90.20151211-0ubuntu12.25.90.20151211-0ubuntu22.25.90.20160101-1ubuntu12.25.90.20160101-1ubuntu22.26-2ubuntu12.26-3ubuntu12.26-4ubuntu12.26-5ubuntu12.26-6ubuntu12.26-7ubuntu22.26-8ubuntu12.26-8ubuntu22.26-8ubuntu2.12.26.1-1ubuntu1~16.042.26.1-1ubuntu1~16.04.12.26.1-1ubuntu1~16.04.32.26.1-1ubuntu1~16.04.42.26.1-1ubuntu1~16.04.52.26.1-1ubuntu1~16.04.62.26.1-1ubuntu1~16.04.72.26.1-1ubuntu1~16.04.8 |
2.26.1-1ubuntu1~16.04.8+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12967 is a medium vulnerability (CVSS 6.5) in Gnu Binutils, published August 19, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.10%, the 87th percentile. Fixed in binutils 2.26.1-1ubuntu1~16.04.10.
References
sourceware.org/bugzilla/show_bug.cgi?id=21962
securityfocus.com/bid/100462
security.gentoo.org/glsa/201801-01
nvd.nist.gov/vuln/detail/CVE-2017-12967
github.com/advisories/GHSA-x93j-fm3w-m5v9
errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459139
Show 150 moreShow less
security-tracker.debian.org/tracker/CVE-2017-12967
ubuntu.com/security/CVE-2017-12967
cve.org/CVERecord?id=CVE-2017-12967