Mageia alert MGASA-2020-0112 (binutils)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2020-0112: Updated binutils packages fix security vulnerabilities | |
| Date: | Fri, 6 Mar 2020 17:15:02 +0100 | |
| Message-ID: | <20200306161502.1B6AF9F74F@duvel.mageia.org> |
MGASA-2020-0112 - Updated binutils packages fix security vulnerabilities Publication date: 06 Mar 2020 URL: https://advisories.mageia.org/MGASA-2020-0112.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-14250, CVE-2019-17450, CVE-2019-17451, CVE-2019-1010204 Description: This update provides the binutils 2.33.1 and fixes atleast the following security issues: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap- based buffer overflow (CVE-2019-14250). find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file )CVE-2019-17450). An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm (CVE-2019-17451). GNU binutils gold linker is affected by Improper Input Validation, Signed/ Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The attack vector is: An ELF file with an invalid e_shoff header field must be opened (CVE-2019-1010204). For more information about the other changes and additional features of binutils / gas / ld in this update, see the referenced sourceware.org NEWS links. References: - https://bugs.mageia.org/show_bug.cgi?id=25298 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;... - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;... - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1... SRPMS: - 7/core/binutils-2.33.1-1.mga7