Security update for binutils
SUSE Security Update: Security update for binutils
binutils has been updated to fix eight security issues:
* Lack of range checking leading to controlled write in
_bfd_elf_setup_sections() (CVE-2014-8485).
* Invalid read flaw in libbfd (CVE-2014-8484).
* Write to uninitialized memory in the PE parser (CVE-2014-8501).
* Crash in the PE parser (CVE-2014-8502).
* Segfault in the ihex parser when it encounters a malformed ihex file
(CVE-2014-8503).
* Stack buffer overflow in srec_scan (CVE-2014-8504).
* Out-of-bounds memory write while processing a crafted "ar" archive
(CVE-2014-8738).
* Directory traversal vulnerability allowing random file
deletion/creation (CVE-2014-8737).
Security Issues:
* CVE-2014-8501
* CVE-2014-8502
* CVE-2014-8503
* CVE-2014-8504
* CVE-2014-8485
* CVE-2014-8738
* CVE-2014-8484
* CVE-2014-8737
Announcement ID: | SUSE-SU-2015:0168-1 |
Rating: | moderate |
References: | #902676 #902677 #903655 #905735 #905736 |
Affected Products: |
An update that fixes 8 vulnerabilities is now available.
Description:
binutils has been updated to fix eight security issues:
* Lack of range checking leading to controlled write in
_bfd_elf_setup_sections() (CVE-2014-8485).
* Invalid read flaw in libbfd (CVE-2014-8484).
* Write to uninitialized memory in the PE parser (CVE-2014-8501).
* Crash in the PE parser (CVE-2014-8502).
* Segfault in the ihex parser when it encounters a malformed ihex file
(CVE-2014-8503).
* Stack buffer overflow in srec_scan (CVE-2014-8504).
* Out-of-bounds memory write while processing a crafted "ar" archive
(CVE-2014-8738).
* Directory traversal vulnerability allowing random file
deletion/creation (CVE-2014-8737).
Security Issues:
* CVE-2014-8501
* CVE-2014-8502
* CVE-2014-8503
* CVE-2014-8504
* CVE-2014-8485
* CVE-2014-8738
* CVE-2014-8484
* CVE-2014-8737
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP3:
zypper in -t patch sdksp3-binutils-201501-10214
- SUSE Linux Enterprise Server 11 SP3 for VMware:
zypper in -t patch slessp3-binutils-201501-10214
- SUSE Linux Enterprise Server 11 SP3:
zypper in -t patch slessp3-binutils-201501-10214
- SUSE Linux Enterprise Desktop 11 SP3:
zypper in -t patch sledsp3-binutils-201501-10214
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):
- binutils-devel-2.23.1-0.23.15
- cross-ppc-binutils-2.23.1-0.23.2
- cross-spu-binutils-2.23.1-0.23.2
- SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64):
- binutils-devel-32bit-2.23.1-0.23.15
- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 x86_64):
- binutils-gold-2.23.1-0.23.15
- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):
- binutils-2.23.1-0.23.15
- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):
- binutils-2.23.1-0.23.15
- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):
- binutils-2.23.1-0.23.15
References:
- http://support.novell.com/security/cve/CVE-2014-8484.html
- http://support.novell.com/security/cve/CVE-2014-8485.html
- http://support.novell.com/security/cve/CVE-2014-8501.html
- http://support.novell.com/security/cve/CVE-2014-8502.html
- http://support.novell.com/security/cve/CVE-2014-8503.html
- http://support.novell.com/security/cve/CVE-2014-8504.html
- http://support.novell.com/security/cve/CVE-2014-8737.html
- http://support.novell.com/security/cve/CVE-2014-8738.html
- https://bugzilla.suse.com/show_bug.cgi?id=902676
- https://bugzilla.suse.com/show_bug.cgi?id=902677
- https://bugzilla.suse.com/show_bug.cgi?id=903655
- https://bugzilla.suse.com/show_bug.cgi?id=905735
- https://bugzilla.suse.com/show_bug.cgi?id=905736
- http://download.suse.com/patch/finder/?keywords=6d27b48bf1cdae29eb4a858e0913fa3f