このbinutilsの2.31への更新では、次の問題を修正します：

次のセキュリティ問題が修正されました：

CVE-2017-15996：readelfでは、ファジングされたアーカイブヘッダーでバッファオーバーフローを発生させる細工されたELFファイルを介して、リモート攻撃者がサービス拒否（過剰なメモリ割り当て）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1065643）。

CVE-2017-15939：Binary File Descriptor（BFD）ライブラリ（別名libbfd）が.debug_lineファイルテーブルのNULLファイルを不適切に処理しました。これにより、リモート攻撃者が、concat_filenameに関連する細工されたELFファイルを介して、サービス拒否（NULLポインターデリファレンスおよびアプリケーションクラッシュ）を引き起こすことができました（bsc#1065689）。

CVE-2017-15938：Binary File Descriptor（BFD）ライブラリ（別名libbfd）が、再配置可能なオブジェクトファイルの場合にDW_FORM_ref_addr refを誤って計算していたため、リモート攻撃者が、サービス拒否（find_abstract_instance_nameの無効なメモリ読み取り、セグメンテーション違反、およびアプリケーションクラッシュ）を引き起こすことができました（bsc#1065693）。

CVE-2017-16826：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のcoff_slurp_line_table関数により、リモート攻撃者が、細工されたPEファイルを介して、サービス拒否（無効なメモリアクセスおよびアプリケーションクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1068640）。

CVE-2017-16832：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のpe_bfd_read_buildid関数は、データ辞書のサイズとオフセットの値を検証しませんでした。これにより、リモート攻撃者が、細工されたPEファイルを介して、サービス拒否（セグメンテーション違反およびアプリケーションクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1068643）。

CVE-2017-16831：Binary File Descriptor（BFD）ライブラリ（別名libbfd）は、シンボル数を検証しませんでした。これにより、リモート攻撃者が、細工されたPEファイルを介して、サービス拒否（整数オーバーフローおよびアプリケーションクラッシュ、または過剰なメモリ割り当て）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1068887）。

CVE-2017-16830：print_gnu_property_note関数では、32ビットプラットフォームで整数オーバーフロー保護がありませんでした。これにより、リモート攻撃者が、細工されたELFファイルを通じて、サービス拒否（セグメンテーション違反およびアプリケーションクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1068888）。

CVE-2017-16829：Binary File Descriptor（BFD）ライブラリ（別名libbfd）の_bfd_elf_parse_gnu_properties関数は、シンボル数を検証しませんでした。これにより、リモート攻撃者が、細工されたPEファイルを介して、サービス拒否（整数オーバーフローおよびアプリケーションクラッシュ、または過剰なメモリ割り当て）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1068950）。

CVE-2017-16828：dwarf.cのdisplay_debug_frames関数により、リモート攻撃者が細工されたELFファイルを介してサービス拒否（整数オーバーフロー、ヒープベースのバッファオーバーリード、およびアプリケーションクラッシュ）を引き起こしたり、その他の詳細不明の影響を与えたりすることができました（bsc#1069176）。

CVE-2017-16827：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のaout_get_external_symbols関数により、リモート攻撃者が細工されたELFファイルを介して、サービス拒否（slurp_symtab無効なフリーおよびアプリケーションクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1069202）。

CVE-2018-6323：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のelf_object_p関数では、bfd_size_type乗算が使用されていないため、符号なし整数オーバーフローが発生します。細工されたELFファイルにより、リモート攻撃者がサービス拒否（アプリケーションのクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1077745）。

CVE-2018-6543：サイズが0の「malloc()」を引き起こすload_specific_debug_section()関数の整数オーバーフローを防ぎます。細工されたELFファイルにより、リモート攻撃者がサービス拒否（アプリケーションのクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました（bsc#1079103）。

CVE-2018-6759：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のbfd_get_debug_link_info_1関数には、非検査strnlen演算があります。リモート攻撃者が、この脆弱性を悪用して、細工したELFファイルを介してしてサービス拒否（セグメンテーション違反）を引き起こす可能性がありました（bsc#1079741）。

CVE-2018-6872：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のelf_parse_notes関数により、リモート攻撃者が、大きなアラインメントのあるノートを通じて、サービス拒否（領域外読み取りおよびセグメンテーション違反）を引き起こすことができました（bsc#1080556）。

CVE-2018-7208：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のcoff_pointerize_aux関数で、インデックスが検証されず、リモート攻撃者が細工されたファイルを介してサービス拒否（セグメンテーション違反）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました。これはCOFFオブジェクトのobjcopyで実証済みです（bsc#1081527）。

CVE-2018-7570：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のassign_file_positions_for_non_load_sections関数により、リモート攻撃者が、一致するLOADセグメントがないRELROセグメントのあるELFファイルを介して、サービス拒否（NULLポインターデリファレンスおよびアプリケーションクラッシュ）を引き起こすことができました。これはobjcopyで実証済みです（bsc#1083528）。

CVE-2018-7569：Binary File Descriptor（BFD）ライブラリ（別名libbfd）により、リモート攻撃者は、破損したDWARF FORMブロックを持つELFファイルを介して、サービス拒否（整数アンダーフローまたはオーバーフロー、およびアプリケーションクラッシュ）を引き起こすことができました。これはnmで実証済みです（bsc#1083532）。 

CVE-2018-8945：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のelf.cのbfd_section_from_shdr関数により、リモート攻撃者が大きな属性セクションを介してサービス拒否（セグメンテーション違反）を引き起こすことができました（bsc#1086608）。

CVE-2018-7643：display_debug_frames関数により、リモート攻撃者が細工されたELFファイルを介してサービス拒否（整数オーバーフローおよびアプリケーションクラッシュ）を引き起こしたり、詳細不明なその他の影響を及ぼしたりすることができました。これは、objdumpで実証済みです（bsc#1086784）。

CVE-2018-7642：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のswap_std_reloc_in関数により、リモート攻撃者が、細工されたELFファイルを介して、サービス拒否（aout_32_swap_std_reloc_outNULLポインターデリファレンスおよびアプリケーションクラッシュ）を引き起こすことができました。これは、objcopyで実証済みです（bsc#1086786）。

CVE-2018-7568：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のparse_die関数により、リモート攻撃者が、破損したdwarf1デバッグ情報を含むELFファイルを介して、サービス拒否（整数オーバーフローおよびアプリケーションクラッシュ）を引き起こすことができました。これは、nmで実証済みです（bsc#1086788）。

CVE-2018-10373：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のconcat_filenameにより、リモート攻撃者が、細工されたバイナリファイルを介して、サービス拒否（NULLポインターデリファレンスおよびアプリケーションクラッシュ）を引き起こすことができました。これは、nm-newで実証済みです（bsc#1090997）。

CVE-2018-10372：process_cu_tu_indexにより、リモート攻撃者が、細工されたバイナリファイルを介して、サービス拒否（ヒープベースのバッファオーバーリードおよびアプリケーションクラッシュ）を引き起こすことができました。これは、readelfで実証済みです（bsc#1091015）。

CVE-2018-10535：Binary File Descriptor（BFD）ライブラリ（別名libbfd）のignore_section_sym関数が、「0」値を持つ「SECTION」タイプのsymtabエントリの場合に、output_sectionポインターを検証しませんでした。これにより、リモート攻撃者が、 細工されたファイルによるサービス拒否（NULLポインターデリファレンスおよびアプリケーションクラッシュ）を引き起こすことができました。これはobjcopyで実証されています（bsc#1091365）。

CVE-2018-10534：Binary File Descriptor（BFD）ライブラリ（別名libbfd）の_bfd_XX_bfd_copy_private_bfd_data_common関数は、負のデータディレクトリサイズを無限ループで処理して、（external_IMAGE_DEBUG_DIRECTORY*の値を増加させます。そのため、アドレスが自身のメモリ領域を超え、領域外メモリ書き込みを引き起こします。これは、objcopyが
pex64igen.cの_bfd_pex64_bfd_copy_private_bfd_data_commonでプライベート情報をコピーすることで実証済みです（bsc#1091368）。

更新パッケージには、セキュリティ以外の修正も含まれています。詳細については、アドバイザリを参照してください。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - binutils: integer overflow via an ELF file with corrupt     dwarf1 debug information in libbfd library     (CVE-2018-7568)

  - binutils: integer underflow or overflow via an ELF file     with a corrupt DWARF FORM block in libbfd library     (CVE-2018-7569)

  - binutils: NULL pointer dereference in swap_std_reloc_in     function in aoutx.h resulting in crash (CVE-2018-7642)

  - binutils: Crash in elf.c:bfd_section_from_shdr() with     crafted executable (CVE-2018-8945)

  - binutils: Heap-base buffer over-read in     dwarf.c:process_cu_tu_index() allows for denial of     service via crafted file (CVE-2018-10372)

  - binutils: NULL pointer dereference in     dwarf2.c:concat_filename() allows for denial of service     via crafted file (CVE-2018-10373)

  - binutils: out of bounds memory write in peXXigen.c     files (CVE-2018-10534)

  - binutils: NULL pointer dereference in elf.c     (CVE-2018-10535)

  - binutils: integer overflow leads to heap-based buffer     overflow in objdump(CVE-2018-1000876)

  - binutils: bfd_elf_attr_strdup heap-based buffer     over-read and application crash(CVE-2017-14130)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information.i1/4^CVE-2018-7568i1/4%0

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information.i1/4^CVE-2018-7569i1/4%0

  - The swap_std_reloc_in function in aoutx.h in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference     and application crash) via a crafted ELF file, as     demonstrated by objcopy.i1/4^CVE-2018-7642i1/4%0

  - The bfd_section_from_shdr function in elf.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (segmentation     fault) via a large attribute     section.i1/4^CVE-2018-8945i1/4%0

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted binary file, as demonstrated by     readelf.i1/4^CVE-2018-10372i1/4%0

  - concat_filename in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.30, allows remote attackers to cause     a denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as     demonstrated by nm-new.i1/4^CVE-2018-10373i1/4%0

  - The _bfd_XX_bfd_copy_private_bfd_data_common function     in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils     2.30, processes a negative Data Directory size with an     unbounded loop that increases the value of     (external_IMAGE_DEBUG_DIRECTORY) *edd so that the     address exceeds its own memory region, resulting in an     out-of-bounds memory write, as demonstrated by objcopy     copying private info with
    _bfd_pex64_bfd_copy_private_bfd_data_common in     pex64igen.c.i1/4^CVE-2018-10534i1/4%0

  - The ignore_section_sym function in elf.c in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the     output_section pointer in the case of a symtab entry     with a 'SECTION' type that has a '0' value, which     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a     crafted file, as demonstrated by     objcopy.i1/4^CVE-2018-10535i1/4%0

  - The _bfd_elf_parse_attributes function in elf-attrs.c     in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.29, allows     remote attackers to cause a denial of service     (_bfd_elf_attr_strdup heap-based buffer over-read and     application crash) via a crafted ELF     file.i1/4^CVE-2017-14130i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - concat_filename in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.30, allows remote attackers to cause     a denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as     demonstrated by nm-new.(CVE-2018-10373)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function     in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils     2.30, processes a negative Data Directory size with an     unbounded loop that increases the value of     (external_IMAGE_DEBUG_DIRECTORY) *edd so that the     address exceeds its own memory region, resulting in an     out-of-bounds memory write, as demonstrated by objcopy     copying private info with
    _bfd_pex64_bfd_copy_private_bfd_data_common in     pex64igen.c.(CVE-2018-10534)

  - The parse_die function in dwarf1.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.30, allows remote attackers to cause     a denial of service (integer overflow and application     crash) via an ELF file with corrupt dwarf1 debug     information, as demonstrated by nm.(CVE-2018-7568)

  - The swap_std_reloc_in function in aoutx.h in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference     and application crash) via a crafted ELF file, as     demonstrated by objcopy.(CVE-2018-7642)

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted binary file, as demonstrated by     readelf.(CVE-2018-10372)

  - In the coff_pointerize_aux function in coffgen.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, an index is not     validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF     object.(CVE-2018-7208)

  - The ignore_section_sym function in elf.c in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the     output_section pointer in the case of a symtab entry     with a ''SECTION'' type that has a ''0'' value, which     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a     crafted file, as demonstrated by     objcopy.(CVE-2018-10535)

  - The display_debug_ranges function in dwarf.c in GNU     Binutils 2.30 allows remote attackers to cause a denial     of service (integer overflow and application crash) or     possibly have unspecified other impact via a crafted     ELF file, as demonstrated by objdump.(CVE-2018-7643)

  - The bfd_section_from_shdr function in elf.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (segmentation     fault) via a large attribute section.(CVE-2018-8945)

  - dwarf2.c in the Binary File Descriptor (BFD) library     (aka libbfd), as distributed in GNU Binutils 2.30,     allows remote attackers to cause a denial of service     (integer underflow or overflow, and application crash)     via an ELF file with a corrupt DWARF FORM block, as     demonstrated by nm.(CVE-2018-7569)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for binutils to version 2.31 fixes the following issues :

These security issues were fixed :

  - CVE-2017-15996: readelf allowed remote attackers to     cause a denial of service (excessive memory allocation)     or possibly have unspecified other impact via a crafted     ELF file that triggered a buffer overflow on fuzzed     archive header (bsc#1065643)

  - CVE-2017-15939: Binary File Descriptor (BFD) library     (aka libbfd) mishandled NULL files in a .debug_line file     table, which allowed remote attackers to cause a denial     of service (NULL pointer dereference and application     crash) via a crafted ELF file, related to     concat_filename (bsc#1065689)

  - CVE-2017-15938: the Binary File Descriptor (BFD) library     (aka libbfd) miscalculated DW_FORM_ref_addr die refs in     the case of a relocatable object file, which allowed     remote attackers to cause a denial of service     (find_abstract_instance_name invalid memory read,     segmentation fault, and application crash) (bsc#1065693)

  - CVE-2017-16826: The coff_slurp_line_table function the     Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (invalid memory access and application crash) or     possibly have unspecified other impact via a crafted PE     file (bsc#1068640)

  - CVE-2017-16832: The pe_bfd_read_buildid function in the     Binary File Descriptor (BFD) library (aka libbfd) did     not validate size and offset values in the data     dictionary, which allowed remote attackers to cause a     denial of service (segmentation violation and     application crash) or possibly have unspecified other     impact via a crafted PE file (bsc#1068643)

  - CVE-2017-16831: Binary File Descriptor (BFD) library     (aka libbfd) did not validate the symbol count, which     allowed remote attackers to cause a denial of service     (integer overflow and application crash, or excessive     memory allocation) or possibly have unspecified other     impact via a crafted PE file (bsc#1068887)

  - CVE-2017-16830: The print_gnu_property_note function did     not have integer-overflow protection on 32-bit     platforms, which allowed remote attackers to cause a     denial of service (segmentation violation and     application crash) or possibly have unspecified other     impact via a crafted ELF file (bsc#1068888)

  - CVE-2017-16829: The _bfd_elf_parse_gnu_properties     function in the Binary File Descriptor (BFD) library     (aka libbfd) did not prevent negative pointers, which     allowed remote attackers to cause a denial of service     (out-of-bounds read and application crash) or possibly     have unspecified other impact via a crafted ELF file     (bsc#1068950)

  - CVE-2017-16828: The display_debug_frames function     allowed remote attackers to cause a denial of service     (integer overflow and heap-based buffer over-read, and     application crash) or possibly have unspecified other     impact via a crafted ELF file (bsc#1069176)

  - CVE-2017-16827: The aout_get_external_symbols function     in the Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (slurp_symtab invalid free and application crash) or     possibly have unspecified other impact via a crafted ELF     file (bsc#1069202)

  - CVE-2018-6323: The elf_object_p function in the Binary     File Descriptor (BFD) library (aka libbfd) had an     unsigned integer overflow because bfd_size_type     multiplication is not used. A crafted ELF file allowed     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact (bsc#1077745)

  - CVE-2018-6543: Prevent integer overflow in the function     load_specific_debug_section() which resulted in     `malloc()` with 0 size. A crafted ELF file allowed     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact (bsc#1079103)

  - CVE-2018-6759: The bfd_get_debug_link_info_1 function in     the Binary File Descriptor (BFD) library (aka libbfd)     had an unchecked strnlen operation. Remote attackers     could have leveraged this vulnerability to cause a     denial of service (segmentation fault) via a crafted ELF     file (bsc#1079741)

  - CVE-2018-6872: The elf_parse_notes function in the     Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (out-of-bounds read and segmentation violation) via a     note with a large alignment (bsc#1080556)

  - CVE-2018-7208: In the coff_pointerize_aux function in     the Binary File Descriptor (BFD) library (aka libbfd) an     index was not validated, which allowed remote attackers     to cause a denial of service (segmentation fault) or     possibly have unspecified other impact via a crafted     file, as demonstrated by objcopy of a COFF object     (bsc#1081527)

  - CVE-2018-7570: The     assign_file_positions_for_non_load_sections function in     the Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via an     ELF file with a RELRO segment that lacks a matching LOAD     segment, as demonstrated by objcopy (bsc#1083528)

  - CVE-2018-7569: The Binary File Descriptor (BFD) library     (aka libbfd) allowed remote attackers to cause a denial     of service (integer underflow or overflow, and     application crash) via an ELF file with a corrupt DWARF     FORM block, as demonstrated by nm (bsc#1083532)

  - CVE-2018-8945: The bfd_section_from_shdr function in the     Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (segmentation fault) via a large attribute section     (bsc#1086608)

  - CVE-2018-7643: The display_debug_ranges function allowed     remote attackers to cause a denial of service (integer     overflow and application crash) or possibly have     unspecified other impact via a crafted ELF file, as     demonstrated by objdump (bsc#1086784)

  - CVE-2018-7642: The swap_std_reloc_in function in the     Binary File Descriptor (BFD) library (aka libbfd)     allowed remote attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference and     application crash) via a crafted ELF file, as     demonstrated by objcopy (bsc#1086786)

  - CVE-2018-7568: The parse_die function in the Binary File     Descriptor (BFD) library (aka libbfd) allowed remote     attackers to cause a denial of service (integer overflow     and application crash) via an ELF file with corrupt     dwarf1 debug information, as demonstrated by nm     (bsc#1086788)

  - CVE-2018-10373: concat_filename in the Binary File     Descriptor (BFD) library (aka libbfd) allowed remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted binary     file, as demonstrated by nm-new (bsc#1090997)

  - CVE-2018-10372: process_cu_tu_index allowed remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) via a crafted     binary file, as demonstrated by readelf (bsc#1091015)

  - CVE-2018-10535: The ignore_section_sym function in the     Binary File Descriptor (BFD) library (aka libbfd) did     not validate the output_section pointer in the case of a     symtab entry with a 'SECTION' type that has a '0' value,     which allowed remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted file, as demonstrated by objcopy     (bsc#1091365)

  - CVE-2018-10534: The
    _bfd_XX_bfd_copy_private_bfd_data_common function in the     Binary File Descriptor (BFD) library (aka libbfd)     processesed a negative Data Directory size with an     unbounded loop that increased the value of     (external_IMAGE_DEBUG_DIRECTORY) *edd so that the     address exceeded its own memory region, resulting in an     out-of-bounds memory write, as demonstrated by objcopy     copying private info with
    _bfd_pex64_bfd_copy_private_bfd_data_common in     pex64igen.c (bsc#1091368)

These non-security issues were fixed :

  - The AArch64 port now supports showing disassembly notes     which are emitted when inconsistencies are found with     the instruction that may result in the instruction being     invalid. These can be turned on with the option -M notes     to objdump.

  - The AArch64 port now emits warnings when a combination     of an instruction and a named register could be invalid.

  - Added O modifier to ar to display member offsets inside     an archive

  - The ADR and ADRL pseudo-instructions supported by the     ARM assembler now only set the bottom bit of the address     of thumb function symbols if the -mthumb-interwork     command line option is active.

  - Add --generate-missing-build-notes=[yes|no] option to     create (or not) GNU Build Attribute notes if none are     present in the input sources. Add a

    --enable-generate-build-notes=[yes|no] configure time     option to set the default behaviour. Set the default if     the configure option is not used to 'no'.

  - Remove -mold-gcc command-line option for x86 targets.

  - Add -O[2|s] command-line options to x86 assembler to     enable alternate shorter instruction encoding.

  - Add support for .nops directive. It is currently     supported only for x86 targets.

  - Speed up direct linking with DLLs for Cygwin and Mingw     targets.

  - Add a configure option --enable-separate-code to decide     whether

    -z separate-code should be enabled in ELF linker by     default. Default to yes for Linux/x86 targets. Note that
    -z separate-code can increase disk and memory size.

  - RISC-V: Fix symbol address problem with versioned     symbols 

  - Restore riscv64-elf cross prefix via symlinks

  - Fix pacemaker libqb problem with section start/stop     symbols

  - RISC-V: Don't enable relaxation in relocatable link

  - Prevent linking faiures on i386 with assertion     (bsc#1085784)

  - Fix symbol size bug when relaxation deletes bytes

  - Add --debug-dump=links option to readelf and
    --dwarf=links option to objdump which displays the     contents of any .gnu_debuglink or .gnu_debugaltlink     sections. Add a --debug-dump=follow-links option to     readelf and a --dwarf=follow-links option to objdump     which causes indirect links into separate debug info     files to be followed when dumping other DWARF sections.

  - Add support for loaction views in DWARF debug line     information.

  - Add -z separate-code to generate separate code PT_LOAD     segment.

  - Add '-z undefs' command line option as the inverse of     the '-z defs' option.

  - Add -z globalaudit command line option to force audit     libraries to be run for every dynamic object loaded by     an executable - provided that the loader supports this     functionality.

  - Tighten linker script grammar around file name     specifiers to prevent the use of SORT_BY_ALIGNMENT and     SORT_BY_INIT_PRIORITY on filenames. These would     previously be accepted but had no effect.

  - The EXCLUDE_FILE directive can now be placed within any     SORT_* directive within input section lists.

  - Fix linker relaxation with --wrap

This update was imported from the SUSE:SLE-15:Update update project.

This update for binutils to version 2.31 fixes the following issues :

These security issues were fixed :

CVE-2017-15996: readelf allowed remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggered a buffer overflow on fuzzed archive header (bsc#1065643)

CVE-2017-15939: Binary File Descriptor (BFD) library (aka libbfd) mishandled NULL files in a .debug_line file table, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename (bsc#1065689)

CVE-2017-15938: the Binary File Descriptor (BFD) library (aka libbfd) miscalculated DW_FORM_ref_addr die refs in the case of a relocatable object file, which allowed remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash) (bsc#1065693)

CVE-2017-16826: The coff_slurp_line_table function the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068640)

CVE-2017-16832: The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate size and offset values in the data dictionary, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068643)

CVE-2017-16831: Binary File Descriptor (BFD) library (aka libbfd) did not validate the symbol count, which allowed remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file (bsc#1068887)

CVE-2017-16830: The print_gnu_property_note function did not have integer-overflow protection on 32-bit platforms, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068888)

CVE-2017-16829: The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library (aka libbfd) did not prevent negative pointers, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068950)

CVE-2017-16828: The display_debug_frames function allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069176)

CVE-2017-16827: The aout_get_external_symbols function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069202)

CVE-2018-6323: The elf_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) had an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1077745)

CVE-2018-6543: Prevent integer overflow in the function load_specific_debug_section() which resulted in `malloc()` with 0 size. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1079103)

CVE-2018-6759: The bfd_get_debug_link_info_1 function in the Binary File Descriptor (BFD) library (aka libbfd) had an unchecked strnlen operation. Remote attackers could have leveraged this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file (bsc#1079741)

CVE-2018-6872: The elf_parse_notes function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment (bsc#1080556)

CVE-2018-7208: In the coff_pointerize_aux function in the Binary File Descriptor (BFD) library (aka libbfd) an index was not validated, which allowed remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object (bsc#1081527)

CVE-2018-7570: The assign_file_positions_for_non_load_sections function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy (bsc#1083528)

CVE-2018-7569: The Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm (bsc#1083532)

CVE-2018-8945: The bfd_section_from_shdr function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (segmentation fault) via a large attribute section (bsc#1086608)

CVE-2018-7643: The display_debug_ranges function allowed remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump (bsc#1086784)

CVE-2018-7642: The swap_std_reloc_in function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy (bsc#1086786)

CVE-2018-7568: The parse_die function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm (bsc#1086788)

CVE-2018-10373: concat_filename in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new (bsc#1090997)

CVE-2018-10372: process_cu_tu_index allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf (bsc#1091015)

CVE-2018-10535: The ignore_section_sym function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate the output_section pointer in the case of a symtab entry with a 'SECTION' type that has a '0' value, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy (bsc#1091365)

CVE-2018-10534: The _bfd_XX_bfd_copy_private_bfd_data_common function in the Binary File Descriptor (BFD) library (aka libbfd) processesed a negative Data Directory size with an unbounded loop that increased the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeded its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with
_bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c (bsc#1091368)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for binutils to 2.31 fixes the following issues :

These security issues were fixed :

CVE-2017-15996: readelf allowed remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggered a buffer overflow on fuzzed archive header (bsc#1065643).

CVE-2017-15939: Binary File Descriptor (BFD) library (aka libbfd) mishandled NULL files in a .debug_line file table, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename (bsc#1065689).

CVE-2017-15938: the Binary File Descriptor (BFD) library (aka libbfd) miscalculated DW_FORM_ref_addr die refs in the case of a relocatable object file, which allowed remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash) (bsc#1065693).

CVE-2017-16826: The coff_slurp_line_table function the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068640).

CVE-2017-16832: The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate size and offset values in the data dictionary, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068643).

CVE-2017-16831: Binary File Descriptor (BFD) library (aka libbfd) did not validate the symbol count, which allowed remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file (bsc#1068887).

CVE-2017-16830: The print_gnu_property_note function did not have integer-overflow protection on 32-bit platforms, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068888).

CVE-2017-16829: The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library (aka libbfd) did not prevent negative pointers, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068950).

CVE-2017-16828: The display_debug_frames function allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069176).

CVE-2017-16827: The aout_get_external_symbols function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069202).

CVE-2018-6323: The elf_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) had an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1077745).

CVE-2018-6543: Prevent integer overflow in the function load_specific_debug_section() which resulted in `malloc()` with 0 size. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1079103).

CVE-2018-6759: The bfd_get_debug_link_info_1 function in the Binary File Descriptor (BFD) library (aka libbfd) had an unchecked strnlen operation. Remote attackers could have leveraged this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file (bsc#1079741).

CVE-2018-6872: The elf_parse_notes function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment (bsc#1080556).

CVE-2018-7208: In the coff_pointerize_aux function in the Binary File Descriptor (BFD) library (aka libbfd) an index was not validated, which allowed remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object (bsc#1081527).

CVE-2018-7570: The assign_file_positions_for_non_load_sections function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy (bsc#1083528).

CVE-2018-7569: The Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm (bsc#1083532).

CVE-2018-8945: The bfd_section_from_shdr function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (segmentation fault) via a large attribute section (bsc#1086608).

CVE-2018-7643: The display_debug_ranges function allowed remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump (bsc#1086784).

CVE-2018-7642: The swap_std_reloc_in function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy (bsc#1086786).

CVE-2018-7568: The parse_die function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm (bsc#1086788).

CVE-2018-10373: concat_filename in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new (bsc#1090997).

CVE-2018-10372: process_cu_tu_index allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf (bsc#1091015).

CVE-2018-10535: The ignore_section_sym function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate the output_section pointer in the case of a symtab entry with a 'SECTION' type that has a '0' value, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy (bsc#1091365).

CVE-2018-10534: The _bfd_XX_bfd_copy_private_bfd_data_common function in the Binary File Descriptor (BFD) library (aka libbfd) processesed a negative Data Directory size with an unbounded loop that increased the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeded its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with
_bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c (bsc#1091368).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for binutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es) :

* binutils: Improper bounds check in coffgen.c:coff_pointerize_aux() allows for denial of service when parsing a crafted COFF file (CVE-2018-7208)

* binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library (CVE-2018-7568)

* binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library (CVE-2018-7569)

* binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash (CVE-2018-7642)

* binutils: Integer overflow in the display_debug_ranges function resulting in crash (CVE-2018-7643)

* binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable (CVE-2018-8945)

* binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file (CVE-2018-10372)

* binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted file (CVE-2018-10373)

* binutils: out of bounds memory write in peXXigen.c files (CVE-2018-10534)

* binutils: NULL pointer dereference in elf.c (CVE-2018-10535)

* binutils: Uncontrolled Resource Consumption in execution of nm (CVE-2018-13033)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote NewStart CGSL host, running version MAIN 6.02, has binutils packages installed that are affected by multiple vulnerabilities:

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.
    (CVE-2018-10372)

  - concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in     GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as demonstrated by nm-new. (CVE-2018-10373)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with     an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address     exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy     copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. (CVE-2018-10534)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a SECTION type that has a 0 value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers     could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
    (CVE-2018-17358)

  - The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a     denial of service (memory consumption), as demonstrated by nm. (CVE-2018-20002)

  - The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication     is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash)     or possibly have unspecified other impact. (CVE-2018-6323)

  - The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could     leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.
    (CVE-2018-6759)

  - In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF object. (CVE-2018-7208)

  - The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow     and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.
    (CVE-2018-7568)

  - dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30,     allows remote attackers to cause a denial of service (integer underflow or overflow, and application     crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. (CVE-2018-7569)

  - The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a     matching LOAD segment, as demonstrated by objcopy. (CVE-2018-7570)

  - The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as     demonstrated by objcopy. (CVE-2018-7642)

  - The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a     denial of service (integer overflow and application crash) or possibly have unspecified other impact via a     crafted ELF file, as demonstrated by objdump. (CVE-2018-7643)

  - The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation     fault) via a large attribute section. (CVE-2018-8945)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - ** DISPUTED ** An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through     14.0. It permits the visual reordering of characters via control sequences, which can be used to craft     source code that renders different logic than the logical ordering of tokens ingested by compilers and     interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such     that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium     offers the following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
118199	SUSE SLED12 / SLES12セキュリティ更新プログラム：binutils（SUSE-SU-2018:3207-1）	Nessus	SuSE Local Security Checks	10/18/2018	7/30/2024	critical
122166	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2019-1019)	Nessus	Huawei Local Security Checks	2/14/2019	6/20/2024	high
123905	EulerOS Virtualization 2.5.4 : binutils (EulerOS-SA-2019-1219)	Nessus	Huawei Local Security Checks	4/9/2019	6/4/2024	medium
124880	EulerOS Virtualization for ARM 64 3.0.1.0 : binutils (EulerOS-SA-2019-1377)	Nessus	Huawei Local Security Checks	5/14/2019	5/23/2024	high
123342	openSUSE Security Update : binutils (openSUSE-2019-808)	Nessus	SuSE Local Security Checks	3/27/2019	6/10/2024	high
120132	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2018:3170-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/10/2024	high
120133	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2018:3170-2)	Nessus	SuSE Local Security Checks	1/2/2019	7/10/2024	high
118199	SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2018:3207-1)	Nessus	SuSE Local Security Checks	10/18/2018	7/30/2024	critical
118303	SUSE SLES12 Security Update : binutils (SUSE-SU-2018:3207-2)	Nessus	SuSE Local Security Checks	10/22/2018	7/30/2024	critical
118983	CentOS 7 : binutils (CESA-2018:3032)	Nessus	CentOS Local Security Checks	11/16/2018	7/22/2024	high
167457	NewStart CGSL MAIN 6.02 : binutils Multiple Vulnerabilities (NS-SA-2022-0087)	Nessus	NewStart CGSL Local Security Checks	11/14/2022	11/15/2022	high

Detections

Analytics

Plugins Search

critical

high

medium

high

high

high

high

critical

critical

high

high