binutils-2.37-1.3 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10651-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z binutils-2.37-1.3 on GA media These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10651 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2014-9939/ SUSE CVE CVE-2014-9939 page https://www.suse.com/security/cve/CVE-2017-12448/ SUSE CVE CVE-2017-12448 page https://www.suse.com/security/cve/CVE-2017-12450/ SUSE CVE CVE-2017-12450 page https://www.suse.com/security/cve/CVE-2017-12452/ SUSE CVE CVE-2017-12452 page https://www.suse.com/security/cve/CVE-2017-12453/ SUSE CVE CVE-2017-12453 page https://www.suse.com/security/cve/CVE-2017-12454/ SUSE CVE CVE-2017-12454 page https://www.suse.com/security/cve/CVE-2017-12456/ SUSE CVE CVE-2017-12456 page https://www.suse.com/security/cve/CVE-2017-12799/ SUSE CVE CVE-2017-12799 page https://www.suse.com/security/cve/CVE-2017-13757/ SUSE CVE CVE-2017-13757 page https://www.suse.com/security/cve/CVE-2017-14128/ SUSE CVE CVE-2017-14128 page https://www.suse.com/security/cve/CVE-2017-14129/ SUSE CVE CVE-2017-14129 page https://www.suse.com/security/cve/CVE-2017-14130/ SUSE CVE CVE-2017-14130 page https://www.suse.com/security/cve/CVE-2017-14333/ SUSE CVE CVE-2017-14333 page https://www.suse.com/security/cve/CVE-2017-14529/ SUSE CVE CVE-2017-14529 page https://www.suse.com/security/cve/CVE-2017-14729/ SUSE CVE CVE-2017-14729 page https://www.suse.com/security/cve/CVE-2017-14745/ SUSE CVE CVE-2017-14745 page https://www.suse.com/security/cve/CVE-2017-14974/ SUSE CVE CVE-2017-14974 page https://www.suse.com/security/cve/CVE-2017-15938/ SUSE CVE CVE-2017-15938 page https://www.suse.com/security/cve/CVE-2017-15939/ SUSE CVE CVE-2017-15939 page https://www.suse.com/security/cve/CVE-2017-15996/ SUSE CVE CVE-2017-15996 page https://www.suse.com/security/cve/CVE-2017-16826/ SUSE CVE CVE-2017-16826 page https://www.suse.com/security/cve/CVE-2017-16827/ SUSE CVE CVE-2017-16827 page https://www.suse.com/security/cve/CVE-2017-16828/ SUSE CVE CVE-2017-16828 page https://www.suse.com/security/cve/CVE-2017-16829/ SUSE CVE CVE-2017-16829 page https://www.suse.com/security/cve/CVE-2017-16830/ SUSE CVE CVE-2017-16830 page https://www.suse.com/security/cve/CVE-2017-16831/ SUSE CVE CVE-2017-16831 page https://www.suse.com/security/cve/CVE-2017-16832/ SUSE CVE CVE-2017-16832 page https://www.suse.com/security/cve/CVE-2017-6965/ SUSE CVE CVE-2017-6965 page https://www.suse.com/security/cve/CVE-2017-6966/ SUSE CVE CVE-2017-6966 page https://www.suse.com/security/cve/CVE-2017-6969/ SUSE CVE CVE-2017-6969 page https://www.suse.com/security/cve/CVE-2017-7209/ SUSE CVE CVE-2017-7209 page https://www.suse.com/security/cve/CVE-2017-7210/ SUSE CVE CVE-2017-7210 page https://www.suse.com/security/cve/CVE-2017-7223/ SUSE CVE CVE-2017-7223 page https://www.suse.com/security/cve/CVE-2017-7224/ SUSE CVE CVE-2017-7224 page https://www.suse.com/security/cve/CVE-2017-7225/ SUSE CVE CVE-2017-7225 page https://www.suse.com/security/cve/CVE-2017-7226/ SUSE CVE CVE-2017-7226 page https://www.suse.com/security/cve/CVE-2017-7299/ SUSE CVE CVE-2017-7299 page https://www.suse.com/security/cve/CVE-2017-7300/ SUSE CVE CVE-2017-7300 page https://www.suse.com/security/cve/CVE-2017-7301/ SUSE CVE CVE-2017-7301 page https://www.suse.com/security/cve/CVE-2017-7302/ SUSE CVE CVE-2017-7302 page https://www.suse.com/security/cve/CVE-2017-7303/ SUSE CVE CVE-2017-7303 page https://www.suse.com/security/cve/CVE-2017-7304/ SUSE CVE CVE-2017-7304 page https://www.suse.com/security/cve/CVE-2017-8392/ SUSE CVE CVE-2017-8392 page https://www.suse.com/security/cve/CVE-2017-8393/ SUSE CVE CVE-2017-8393 page https://www.suse.com/security/cve/CVE-2017-8394/ SUSE CVE CVE-2017-8394 page https://www.suse.com/security/cve/CVE-2017-8396/ SUSE CVE CVE-2017-8396 page https://www.suse.com/security/cve/CVE-2017-8421/ SUSE CVE CVE-2017-8421 page https://www.suse.com/security/cve/CVE-2017-9746/ SUSE CVE CVE-2017-9746 page https://www.suse.com/security/cve/CVE-2017-9747/ SUSE CVE CVE-2017-9747 page https://www.suse.com/security/cve/CVE-2017-9748/ SUSE CVE CVE-2017-9748 page https://www.suse.com/security/cve/CVE-2017-9750/ SUSE CVE CVE-2017-9750 page https://www.suse.com/security/cve/CVE-2017-9755/ SUSE CVE CVE-2017-9755 page https://www.suse.com/security/cve/CVE-2017-9756/ SUSE CVE CVE-2017-9756 page https://www.suse.com/security/cve/CVE-2018-1000876/ SUSE CVE CVE-2018-1000876 page https://www.suse.com/security/cve/CVE-2018-10372/ SUSE CVE CVE-2018-10372 page https://www.suse.com/security/cve/CVE-2018-10373/ SUSE CVE CVE-2018-10373 page https://www.suse.com/security/cve/CVE-2018-10534/ SUSE CVE CVE-2018-10534 page https://www.suse.com/security/cve/CVE-2018-10535/ SUSE CVE CVE-2018-10535 page https://www.suse.com/security/cve/CVE-2018-17358/ SUSE CVE CVE-2018-17358 page https://www.suse.com/security/cve/CVE-2018-17359/ SUSE CVE CVE-2018-17359 page https://www.suse.com/security/cve/CVE-2018-17360/ SUSE CVE CVE-2018-17360 page https://www.suse.com/security/cve/CVE-2018-17985/ SUSE CVE CVE-2018-17985 page https://www.suse.com/security/cve/CVE-2018-18309/ SUSE CVE CVE-2018-18309 page https://www.suse.com/security/cve/CVE-2018-18483/ SUSE CVE CVE-2018-18483 page https://www.suse.com/security/cve/CVE-2018-18484/ SUSE CVE CVE-2018-18484 page https://www.suse.com/security/cve/CVE-2018-18605/ SUSE CVE CVE-2018-18605 page https://www.suse.com/security/cve/CVE-2018-18606/ SUSE CVE CVE-2018-18606 page https://www.suse.com/security/cve/CVE-2018-18607/ SUSE CVE CVE-2018-18607 page https://www.suse.com/security/cve/CVE-2018-19931/ SUSE CVE CVE-2018-19931 page https://www.suse.com/security/cve/CVE-2018-19932/ SUSE CVE CVE-2018-19932 page https://www.suse.com/security/cve/CVE-2018-20623/ SUSE CVE CVE-2018-20623 page https://www.suse.com/security/cve/CVE-2018-20651/ SUSE CVE CVE-2018-20651 page https://www.suse.com/security/cve/CVE-2018-20671/ SUSE CVE CVE-2018-20671 page https://www.suse.com/security/cve/CVE-2018-6323/ SUSE CVE CVE-2018-6323 page https://www.suse.com/security/cve/CVE-2018-6543/ SUSE CVE CVE-2018-6543 page https://www.suse.com/security/cve/CVE-2018-6759/ SUSE CVE CVE-2018-6759 page https://www.suse.com/security/cve/CVE-2018-6872/ SUSE CVE CVE-2018-6872 page https://www.suse.com/security/cve/CVE-2018-7208/ SUSE CVE CVE-2018-7208 page https://www.suse.com/security/cve/CVE-2018-7568/ SUSE CVE CVE-2018-7568 page https://www.suse.com/security/cve/CVE-2018-7569/ SUSE CVE CVE-2018-7569 page https://www.suse.com/security/cve/CVE-2018-7570/ SUSE CVE CVE-2018-7570 page https://www.suse.com/security/cve/CVE-2018-7642/ SUSE CVE CVE-2018-7642 page https://www.suse.com/security/cve/CVE-2018-7643/ SUSE CVE CVE-2018-7643 page https://www.suse.com/security/cve/CVE-2018-8945/ SUSE CVE CVE-2018-8945 page https://www.suse.com/security/cve/CVE-2019-1010180/ SUSE CVE CVE-2019-1010180 page https://www.suse.com/security/cve/CVE-2019-12972/ SUSE CVE CVE-2019-12972 page https://www.suse.com/security/cve/CVE-2019-14250/ SUSE CVE CVE-2019-14250 page https://www.suse.com/security/cve/CVE-2019-14444/ SUSE CVE CVE-2019-14444 page https://www.suse.com/security/cve/CVE-2019-17450/ SUSE CVE CVE-2019-17450 page https://www.suse.com/security/cve/CVE-2019-17451/ SUSE CVE CVE-2019-17451 page https://www.suse.com/security/cve/CVE-2019-9074/ SUSE CVE CVE-2019-9074 page https://www.suse.com/security/cve/CVE-2019-9075/ SUSE CVE CVE-2019-9075 page https://www.suse.com/security/cve/CVE-2019-9077/ SUSE CVE CVE-2019-9077 page https://www.suse.com/security/cve/CVE-2020-16590/ SUSE CVE CVE-2020-16590 page https://www.suse.com/security/cve/CVE-2020-16591/ SUSE CVE CVE-2020-16591 page https://www.suse.com/security/cve/CVE-2020-16592/ SUSE CVE CVE-2020-16592 page https://www.suse.com/security/cve/CVE-2020-16593/ SUSE CVE CVE-2020-16593 page https://www.suse.com/security/cve/CVE-2020-16598/ SUSE CVE CVE-2020-16598 page https://www.suse.com/security/cve/CVE-2020-16599/ SUSE CVE CVE-2020-16599 page https://www.suse.com/security/cve/CVE-2020-35448/ SUSE CVE CVE-2020-35448 page https://www.suse.com/security/cve/CVE-2020-35493/ SUSE CVE CVE-2020-35493 page https://www.suse.com/security/cve/CVE-2020-35496/ SUSE CVE CVE-2020-35496 page https://www.suse.com/security/cve/CVE-2020-35507/ SUSE CVE CVE-2020-35507 page https://www.suse.com/security/cve/CVE-2021-20197/ SUSE CVE CVE-2021-20197 page https://www.suse.com/security/cve/CVE-2021-20284/ SUSE CVE CVE-2021-20284 page https://www.suse.com/security/cve/CVE-2021-3487/ SUSE CVE CVE-2021-3487 page openSUSE Tumbleweed binutils-2.37-1.3 binutils-devel-2.37-1.3 binutils-devel-32bit-2.37-1.3 binutils-gold-2.37-1.3 libctf-nobfd0-2.37-1.3 libctf0-2.37-1.3 binutils-2.37-1.3 as a component of openSUSE Tumbleweed binutils-devel-2.37-1.3 as a component of openSUSE Tumbleweed binutils-devel-32bit-2.37-1.3 as a component of openSUSE Tumbleweed binutils-gold-2.37-1.3 as a component of openSUSE Tumbleweed libctf-nobfd0-2.37-1.3 as a component of openSUSE Tumbleweed libctf0-2.37-1.3 as a component of openSUSE Tumbleweed ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects. CVE-2014-9939 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-9939.html CVE-2014-9939 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1105209 SUSE Bug 1105209 The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c. CVE-2017-12448 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12448.html CVE-2017-12448 https://bugzilla.suse.com/1052518 SUSE Bug 1052518 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file. CVE-2017-12450 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12450.html CVE-2017-12450 https://bugzilla.suse.com/1052514 SUSE Bug 1052514 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file. CVE-2017-12452 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12452.html CVE-2017-12452 https://bugzilla.suse.com/1052511 SUSE Bug 1052511 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file. CVE-2017-12453 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12453.html CVE-2017-12453 https://bugzilla.suse.com/1052509 SUSE Bug 1052509 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file. CVE-2017-12454 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12454.html CVE-2017-12454 https://bugzilla.suse.com/1052507 SUSE Bug 1052507 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file. CVE-2017-12456 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12456.html CVE-2017-12456 https://bugzilla.suse.com/1052503 SUSE Bug 1052503 https://bugzilla.suse.com/1059785 SUSE Bug 1059785 The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file. CVE-2017-12799 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 3.2 AV:L/AC:L/Au:S/C:N/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12799.html CVE-2017-12799 https://bugzilla.suse.com/1053347 SUSE Bug 1053347 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c. CVE-2017-13757 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-13757.html CVE-2017-13757 https://bugzilla.suse.com/1056312 SUSE Bug 1056312 The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file. CVE-2017-14128 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14128.html CVE-2017-14128 https://bugzilla.suse.com/1057139 SUSE Bug 1057139 The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file. CVE-2017-14129 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14129.html CVE-2017-14129 https://bugzilla.suse.com/1057144 SUSE Bug 1057144 The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file. CVE-2017-14130 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14130.html CVE-2017-14130 https://bugzilla.suse.com/1057149 SUSE Bug 1057149 The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution. CVE-2017-14333 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14333.html CVE-2017-14333 https://bugzilla.suse.com/1058480 SUSE Bug 1058480 The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function. CVE-2017-14529 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14529.html CVE-2017-14529 https://bugzilla.suse.com/1059050 SUSE Bug 1059050 The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c. CVE-2017-14729 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14729.html CVE-2017-14729 https://bugzilla.suse.com/1060621 SUSE Bug 1060621 The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c. CVE-2017-14745 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14745.html CVE-2017-14745 https://bugzilla.suse.com/1060599 SUSE Bug 1060599 The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c. CVE-2017-14974 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14974.html CVE-2017-14974 https://bugzilla.suse.com/1061241 SUSE Bug 1061241 dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash). CVE-2017-15938 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-15938.html CVE-2017-15938 https://bugzilla.suse.com/1065693 SUSE Bug 1065693 dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023. CVE-2017-15939 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-15939.html CVE-2017-15939 https://bugzilla.suse.com/1061623 SUSE Bug 1061623 https://bugzilla.suse.com/1065689 SUSE Bug 1065689 elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions. CVE-2017-15996 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-15996.html CVE-2017-15996 https://bugzilla.suse.com/1065643 SUSE Bug 1065643 The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file. CVE-2017-16826 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16826.html CVE-2017-16826 https://bugzilla.suse.com/1068640 SUSE Bug 1068640 The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file. CVE-2017-16827 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16827.html CVE-2017-16827 https://bugzilla.suse.com/1069202 SUSE Bug 1069202 The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame. CVE-2017-16828 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16828.html CVE-2017-16828 https://bugzilla.suse.com/1069176 SUSE Bug 1069176 The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file. CVE-2017-16829 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16829.html CVE-2017-16829 https://bugzilla.suse.com/1068950 SUSE Bug 1068950 The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file. CVE-2017-16830 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16830.html CVE-2017-16830 https://bugzilla.suse.com/1068888 SUSE Bug 1068888 coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file. CVE-2017-16831 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16831.html CVE-2017-16831 https://bugzilla.suse.com/1068887 SUSE Bug 1068887 The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file. CVE-2017-16832 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16832.html CVE-2017-16832 https://bugzilla.suse.com/1068643 SUSE Bug 1068643 readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow. CVE-2017-6965 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6965.html CVE-2017-6965 https://bugzilla.suse.com/1029909 SUSE Bug 1029909 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations. CVE-2017-6966 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6966.html CVE-2017-6966 https://bugzilla.suse.com/1029908 SUSE Bug 1029908 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well. CVE-2017-6969 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 critical 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6969.html CVE-2017-6969 https://bugzilla.suse.com/1029907 SUSE Bug 1029907 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1105209 SUSE Bug 1105209 The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash. CVE-2017-7209 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7209.html CVE-2017-7209 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030298 SUSE Bug 1030298 objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash. CVE-2017-7210 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7210.html CVE-2017-7210 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030297 SUSE Bug 1030297 GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash. CVE-2017-7223 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7223.html CVE-2017-7223 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030589 SUSE Bug 1030589 The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash. CVE-2017-7224 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7224.html CVE-2017-7224 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030588 SUSE Bug 1030588 The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash. CVE-2017-7225 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7225.html CVE-2017-7225 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030585 SUSE Bug 1030585 The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well. CVE-2017-7226 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 critical 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7226.html CVE-2017-7226 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1030584 SUSE Bug 1030584 https://bugzilla.suse.com/1105209 SUSE Bug 1105209 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash. CVE-2017-7299 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7299.html CVE-2017-7299 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031644 SUSE Bug 1031644 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash. CVE-2017-7300 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7300.html CVE-2017-7300 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031656 SUSE Bug 1031656 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash. CVE-2017-7301 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7301.html CVE-2017-7301 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031638 SUSE Bug 1031638 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash. CVE-2017-7302 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7302.html CVE-2017-7302 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031595 SUSE Bug 1031595 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash. CVE-2017-7303 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7303.html CVE-2017-7303 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031593 SUSE Bug 1031593 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash. CVE-2017-7304 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7304.html CVE-2017-7304 https://bugzilla.suse.com/1030295 SUSE Bug 1030295 https://bugzilla.suse.com/1031590 SUSE Bug 1031590 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash. CVE-2017-8392 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8392.html CVE-2017-8392 https://bugzilla.suse.com/1037052 SUSE Bug 1037052 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash. CVE-2017-8393 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8393.html CVE-2017-8393 https://bugzilla.suse.com/1037057 SUSE Bug 1037057 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash. CVE-2017-8394 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8394.html CVE-2017-8394 https://bugzilla.suse.com/1037061 SUSE Bug 1037061 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash. CVE-2017-8396 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8396.html CVE-2017-8396 https://bugzilla.suse.com/1037066 SUSE Bug 1037066 The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this. CVE-2017-8421 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8421.html CVE-2017-8421 https://bugzilla.suse.com/1037273 SUSE Bug 1037273 The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution. CVE-2017-9746 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9746.html CVE-2017-9746 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044891 SUSE Bug 1044891 The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. CVE-2017-9747 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9747.html CVE-2017-9747 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044897 SUSE Bug 1044897 The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. CVE-2017-9748 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9748.html CVE-2017-9748 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044901 SUSE Bug 1044901 opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. CVE-2017-9750 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9750.html CVE-2017-9750 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044909 SUSE Bug 1044909 opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. CVE-2017-9755 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9755.html CVE-2017-9755 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044925 SUSE Bug 1044925 The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. CVE-2017-9756 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9756.html CVE-2017-9756 https://bugzilla.suse.com/1030296 SUSE Bug 1030296 https://bugzilla.suse.com/1044927 SUSE Bug 1044927 binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. CVE-2018-1000876 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000876.html CVE-2018-1000876 https://bugzilla.suse.com/1120640 SUSE Bug 1120640 process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf. CVE-2018-10372 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10372.html CVE-2018-10372 https://bugzilla.suse.com/1091015 SUSE Bug 1091015 concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new. CVE-2018-10373 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10373.html CVE-2018-10373 https://bugzilla.suse.com/1090997 SUSE Bug 1090997 The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. CVE-2018-10534 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10534.html CVE-2018-10534 https://bugzilla.suse.com/1091368 SUSE Bug 1091368 The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy. CVE-2018-10535 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10535.html CVE-2018-10535 https://bugzilla.suse.com/1091365 SUSE Bug 1091365 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. CVE-2018-17358 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-17358.html CVE-2018-17358 https://bugzilla.suse.com/1109412 SUSE Bug 1109412 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. CVE-2018-17359 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-17359.html CVE-2018-17359 https://bugzilla.suse.com/1109413 SUSE Bug 1109413 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. CVE-2018-17360 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-17360.html CVE-2018-17360 https://bugzilla.suse.com/1109414 SUSE Bug 1109414 An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters. CVE-2018-17985 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-17985.html CVE-2018-17985 https://bugzilla.suse.com/1116827 SUSE Bug 1116827 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking. CVE-2018-18309 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18309.html CVE-2018-18309 https://bugzilla.suse.com/1111996 SUSE Bug 1111996 The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt. CVE-2018-18483 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18483.html CVE-2018-18483 https://bugzilla.suse.com/1112535 SUSE Bug 1112535 An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type. CVE-2018-18484 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18484.html CVE-2018-18484 https://bugzilla.suse.com/1112534 SUSE Bug 1112534 A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18605 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18605.html CVE-2018-18605 https://bugzilla.suse.com/1113255 SUSE Bug 1113255 An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18606 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18606.html CVE-2018-18606 https://bugzilla.suse.com/1113252 SUSE Bug 1113252 An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18607 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18607.html CVE-2018-18607 https://bugzilla.suse.com/1113247 SUSE Bug 1113247 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. CVE-2018-19931 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19931.html CVE-2018-19931 https://bugzilla.suse.com/1118830 SUSE Bug 1118830 https://bugzilla.suse.com/1118831 SUSE Bug 1118831 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c. CVE-2018-19932 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19932.html CVE-2018-19932 https://bugzilla.suse.com/1118830 SUSE Bug 1118830 https://bugzilla.suse.com/1118831 SUSE Bug 1118831 In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file. CVE-2018-20623 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20623.html CVE-2018-20623 https://bugzilla.suse.com/1121035 SUSE Bug 1121035 A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-20651 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20651.html CVE-2018-20651 https://bugzilla.suse.com/1121034 SUSE Bug 1121034 load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size. CVE-2018-20671 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20671.html CVE-2018-20671 https://bugzilla.suse.com/1121056 SUSE Bug 1121056 The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-6323 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-6323.html CVE-2018-6323 https://bugzilla.suse.com/1077745 SUSE Bug 1077745 In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-6543 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-6543.html CVE-2018-6543 https://bugzilla.suse.com/1079103 SUSE Bug 1079103 The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file. CVE-2018-6759 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-6759.html CVE-2018-6759 https://bugzilla.suse.com/1079741 SUSE Bug 1079741 The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment. CVE-2018-6872 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-6872.html CVE-2018-6872 https://bugzilla.suse.com/1080556 SUSE Bug 1080556 In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object. CVE-2018-7208 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7208.html CVE-2018-7208 https://bugzilla.suse.com/1081527 SUSE Bug 1081527 The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm. CVE-2018-7568 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7568.html CVE-2018-7568 https://bugzilla.suse.com/1086788 SUSE Bug 1086788 dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. CVE-2018-7569 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7569.html CVE-2018-7569 https://bugzilla.suse.com/1083532 SUSE Bug 1083532 The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy. CVE-2018-7570 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7570.html CVE-2018-7570 https://bugzilla.suse.com/1083528 SUSE Bug 1083528 The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy. CVE-2018-7642 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7642.html CVE-2018-7642 https://bugzilla.suse.com/1086786 SUSE Bug 1086786 https://bugzilla.suse.com/1128518 SUSE Bug 1128518 The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump. CVE-2018-7643 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-7643.html CVE-2018-7643 https://bugzilla.suse.com/1086784 SUSE Bug 1086784 The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section. CVE-2018-8945 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-8945.html CVE-2018-8945 https://bugzilla.suse.com/1086608 SUSE Bug 1086608 GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet. CVE-2019-1010180 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1010180.html CVE-2019-1010180 https://bugzilla.suse.com/1142772 SUSE Bug 1142772 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character. CVE-2019-12972 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-12972.html CVE-2019-12972 https://bugzilla.suse.com/1140126 SUSE Bug 1140126 An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow. CVE-2019-14250 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14250.html CVE-2019-14250 https://bugzilla.suse.com/1142649 SUSE Bug 1142649 apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf. CVE-2019-14444 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14444.html CVE-2019-14444 https://bugzilla.suse.com/1143609 SUSE Bug 1143609 find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file. CVE-2019-17450 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-17450.html CVE-2019-17450 https://bugzilla.suse.com/1153770 SUSE Bug 1153770 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm. CVE-2019-17451 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-17451.html CVE-2019-17451 https://bugzilla.suse.com/1153768 SUSE Bug 1153768 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c. CVE-2019-9074 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9074.html CVE-2019-9074 https://bugzilla.suse.com/1126831 SUSE Bug 1126831 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c. CVE-2019-9075 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9075.html CVE-2019-9075 https://bugzilla.suse.com/1071544 SUSE Bug 1071544 https://bugzilla.suse.com/1126829 SUSE Bug 1126829 https://bugzilla.suse.com/1193110 SUSE Bug 1193110 An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section. CVE-2019-9077 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9077.html CVE-2019-9077 https://bugzilla.suse.com/1126826 SUSE Bug 1126826 A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file. CVE-2020-16590 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16590.html CVE-2020-16590 https://bugzilla.suse.com/1179898 SUSE Bug 1179898 A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif. CVE-2020-16591 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16591.html CVE-2020-16591 https://bugzilla.suse.com/1179899 SUSE Bug 1179899 A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file. CVE-2020-16592 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16592.html CVE-2020-16592 https://bugzilla.suse.com/1179900 SUSE Bug 1179900 A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file. CVE-2020-16593 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16593.html CVE-2020-16593 https://bugzilla.suse.com/1179901 SUSE Bug 1179901 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2020-16598 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16598.html CVE-2020-16598 https://bugzilla.suse.com/1179902 SUSE Bug 1179902 A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file. CVE-2020-16599 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-16599.html CVE-2020-16599 https://bugzilla.suse.com/1179903 SUSE Bug 1179903 https://bugzilla.suse.com/1206080 SUSE Bug 1206080 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. CVE-2020-35448 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-35448.html CVE-2020-35448 https://bugzilla.suse.com/1184794 SUSE Bug 1184794 A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. CVE-2020-35493 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-35493.html CVE-2020-35493 https://bugzilla.suse.com/1180451 SUSE Bug 1180451 There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. CVE-2020-35496 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-35496.html CVE-2020-35496 https://bugzilla.suse.com/1180454 SUSE Bug 1180454 There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. CVE-2020-35507 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-35507.html CVE-2020-35507 https://bugzilla.suse.com/1180461 SUSE Bug 1180461 There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. CVE-2021-20197 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 3.3 AV:L/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-20197.html CVE-2021-20197 https://bugzilla.suse.com/1181452 SUSE Bug 1181452 A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability. CVE-2021-20284 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-20284.html CVE-2021-20284 https://bugzilla.suse.com/1183511 SUSE Bug 1183511 ** REJECT ** Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt CVE-2021-3487 openSUSE Tumbleweed:binutils-2.37-1.3 openSUSE Tumbleweed:binutils-devel-2.37-1.3 openSUSE Tumbleweed:binutils-devel-32bit-2.37-1.3 openSUSE Tumbleweed:binutils-gold-2.37-1.3 openSUSE Tumbleweed:libctf-nobfd0-2.37-1.3 openSUSE Tumbleweed:libctf0-2.37-1.3 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3487.html CVE-2021-3487 https://bugzilla.suse.com/1184620 SUSE Bug 1184620