CVE-2017-9038

Name	CVE-2017-9038
Description	GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	863674

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
binutils (PTS)	jessie, jessie (lts)	2.25-5+deb8u2	vulnerable
	stretch (lts), stretch	2.28-5+deb9u1	vulnerable
	buster, buster (lts)	2.31.1-16+deb10u1	fixed
	bullseye	2.35.2-2	fixed
	bookworm	2.40-2	fixed
	sid, trixie	2.43.1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
binutils	source	(unstable)	2.28-6	low		863674

Notes

[stretch] - binutils <ignored> (Minor issue)
[jessie] - binutils <ignored> (Minor issue)
[wheezy] - binutils <no-dsa> (Minor issue)
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f32ba72991d2406b21ab17edc234a2f3fa7fb23d