GHSA-jvp9-phwp-p738

LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind

Source: GitHub Advisory Database (reviewed) High CVE-2022-43171

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	lief	< 0.12.3	0.12.3

Details

As written in the advisory (Markdown source, shown as plain text).

A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF prior to version 0.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MachO file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-43171 advisory
https://github.com/lief-project/LIEF/issues/782 web
https://github.com/lief-project/LIEF package
https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2022-43140.yaml web