SUSE-SU-2019:2650-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2019/suse-su-20192650-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:2650-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2019:2650-1

Related

Published

2019-10-14T08:53:28Z

Modified

2019-10-14T08:53:28Z

Summary

Security update for binutils

Details

This update for binutils fixes the following issues:

binutils was updated to current 2.32 branch @7b468db3 [jsc#ECO-368]:

Includes the following security fixes:

CVE-2018-17358: Fixed invalid memory access in bfdstabsectionfindnearestline in syms.c (bsc#1109412)
CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)
CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)
CVE-2018-17985: Fixed a stack consumption problem caused by the cplusdemangletype (bsc#1116827)
CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)
CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)
CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)
CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function secmergehash_lookup causing a denial of service (bsc#1113255)
CVE-2018-18606: Fixed a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)
CVE-2018-18607: Fixed a NULL pointer dereference in elflinkinputbfd when used for finding STTTLS symbols without any TLS section, causing denial of service (bsc#1113247)
CVE-2018-19931: Fixed a heap-based buffer overflow in bfdelf32swapphdrin in elfcode.h (bsc#1118831)
CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the ISCONTAINEDBY_LMA (bsc#1118830)
CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)
CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elflinkaddobjectsymbols in elflink.c (bsc#1121034)
CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in loadspecificdebug_section in objdump.c (bsc#1121056)
CVE-2018-1000876: Fixed integer overflow in bfdgetdynamicrelocupperbound,bfdcanonicalizedynamicreloc in objdump (bsc#1120640)
CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)
Enable xtensa architecture (Tensilica lc6 and related)
Use -ffat-lto-objects in order to provide assembly for static libs (bsc#1141913).
Fixed some LTO problems (bsc#1133131 bsc#1133232).
riscv: Don't check ABI flags if no code section

Update to binutils 2.32:

The binutils now support for the C-SKY processor series.
The x86 assembler now supports a -mvexwig=[0|1] option to control encoding of VEX.W-ignored (WIG) VEX instructions. It also has a new -mx86-used-note=[yes|no] option to generate (or not) x86 GNU property notes.
The MIPS assembler now supports the Loongson EXTensions R2 (EXT2), the Loongson EXTensions (EXT) instructions, the Loongson Content Address Memory (CAM) ASE and the Loongson MultiMedia extensions Instructions (MMI) ASE.
The addr2line, c++filt, nm and objdump tools now have a default limit on the maximum amount of recursion that is allowed whilst demangling strings. This limit can be disabled if necessary.
Objdump's --disassemble option can now take a parameter, specifying the starting symbol for disassembly. Disassembly will continue from this symbol up to the next symbol or the end of the function.
The BFD linker will now report property change in linker map file when merging GNU properties.
The BFD linker's -t option now doesn't report members within archives, unless -t is given twice. This makes it more useful when generating a list of files that should be packaged for a linker bug report.
The GOLD linker has improved warning messages for relocations that refer to discarded sections.
Improve relro support on s390 [fate#326356]
Handle ELF compressed header alignment correctly.

References

Affected packages

SUSE:HPE Helion OpenStack 8 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=HPE%20Helion%20OpenStack%208

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:OpenStack Cloud 7 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:OpenStack Cloud 8 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20OpenStack%20Cloud%208

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:OpenStack Cloud Crowbar 8 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Desktop 12 SP4 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP4 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP4 / cross-ppc-binutils

Package

Name: cross-ppc-binutils
Purl: purl:rpm/suse/cross-ppc-binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP4 / cross-spu-binutils

Package

Name: cross-spu-binutils
Purl: purl:rpm/suse/cross-spu-binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP5 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP5 / cross-ppc-binutils

Package

Name: cross-ppc-binutils
Purl: purl:rpm/suse/cross-ppc-binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP5 / cross-spu-binutils

Package

Name: cross-spu-binutils
Purl: purl:rpm/suse/cross-spu-binutils&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils-gold": "2.32-9.33.1",
            "cross-ppc-binutils": "2.32-9.33.1",
            "cross-spu-binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-LTSS / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-BCL / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP3-LTSS / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP3-BCL / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP4 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP5 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP5 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils-devel": "2.32-9.33.1",
            "binutils": "2.32-9.33.1"
        }
    ]
}

SUSE:Enterprise Storage 5 / binutils

Package

Name: binutils
Purl: purl:rpm/suse/binutils&distro=SUSE%20Enterprise%20Storage%205

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.32-9.33.1

Ecosystem specific

{
    "binaries": [
        {
            "binutils": "2.32-9.33.1"
        }
    ]
}