Security update for elfutils

SUSE Security Update: Security update for elfutils
Announcement ID: SUSE-SU-2019:1486-1
Rating: moderate
References: #1033084 #1033085 #1033086 #1033087 #1033088 #1033089 #1033090 #1106390 #1107066 #1107067 #1111973 #1112723 #1112726 #1123685 #1125007
Cross-References: CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062 CVE-2018-16402 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7150 CVE-2019-7665
Affected Products:
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1
  • SUSE Linux Enterprise Module for Basesystem 15-SP1
  • SUSE Linux Enterprise Module for Basesystem 15

An update that fixes 15 vulnerabilities is now available.

Description:

This update for elfutils fixes the following issues:
Security issues fixed:

  • CVE-2017-7607: Fixed a heap-based buffer overflow in handle_gnu_hash (bsc#1033084)
  • CVE-2017-7608: Fixed a heap-based buffer overflow in ebl_object_note_type_name() (bsc#1033085)
  • CVE-2017-7609: Fixed a memory allocation failure in __libelf_decompress (bsc#1033086)
  • CVE-2017-7610: Fixed a heap-based buffer overflow in check_group (bsc#1033087)
  • CVE-2017-7611: Fixed a denial of service via a crafted ELF file (bsc#1033088)
  • CVE-2017-7612: Fixed a denial of service in check_sysv_hash() via a crafted ELF file (bsc#1033089)
  • CVE-2017-7613: Fixed denial of service caused by the missing validation of the number of sections and the number of segments in a crafted ELF file (bsc#1033090)
  • CVE-2018-16062: Fixed a heap-buffer overflow in /elfutils/libdw/dwarf_getaranges.c:156 (bsc#1106390)
  • CVE-2018-16402: Fixed a denial of service/double free on an attempt to decompress the same section twice (bsc#1107066)
  • CVE-2018-16403: Fixed a heap buffer overflow in readelf (bsc#1107067)
  • CVE-2018-18310: Fixed an invalid address read problem in dwfl_segment_report_module.c (bsc#1111973)
  • CVE-2018-18520: Fixed bad handling of ar files inside are files (bsc#1112726)
  • CVE-2018-18521: Fixed a denial of service vulnerabilities in the function arlib_add_symbols() used by eu-ranlib (bsc#1112723)
  • CVE-2019-7150: dwfl_segment_report_module doesn't check whether the dyn data read from core file is truncated (bsc#1123685)
  • CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (bsc#1125007)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1486=1
  • SUSE Linux Enterprise Module for Basesystem 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-1486=1
  • SUSE Linux Enterprise Module for Basesystem 15:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-1486=1

Package List:

  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (x86_64):
    • elfutils-debugsource-0.168-4.5.3
    • libasm1-32bit-0.168-4.5.3
    • libasm1-32bit-debuginfo-0.168-4.5.3
    • libelf-devel-32bit-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64):
    • elfutils-0.168-4.5.3
    • elfutils-debuginfo-0.168-4.5.3
    • elfutils-debugsource-0.168-4.5.3
    • libasm-devel-0.168-4.5.3
    • libasm1-0.168-4.5.3
    • libasm1-debuginfo-0.168-4.5.3
    • libdw-devel-0.168-4.5.3
    • libdw1-0.168-4.5.3
    • libdw1-debuginfo-0.168-4.5.3
    • libebl-devel-0.168-4.5.3
    • libebl-plugins-0.168-4.5.3
    • libebl-plugins-debuginfo-0.168-4.5.3
    • libelf-devel-0.168-4.5.3
    • libelf1-0.168-4.5.3
    • libelf1-debuginfo-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch):
    • elfutils-lang-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15-SP1 (x86_64):
    • libdw1-32bit-0.168-4.5.3
    • libdw1-32bit-debuginfo-0.168-4.5.3
    • libebl-plugins-32bit-0.168-4.5.3
    • libebl-plugins-32bit-debuginfo-0.168-4.5.3
    • libelf1-32bit-0.168-4.5.3
    • libelf1-32bit-debuginfo-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64):
    • elfutils-0.168-4.5.3
    • elfutils-debuginfo-0.168-4.5.3
    • elfutils-debugsource-0.168-4.5.3
    • libasm-devel-0.168-4.5.3
    • libasm1-0.168-4.5.3
    • libasm1-debuginfo-0.168-4.5.3
    • libdw-devel-0.168-4.5.3
    • libdw1-0.168-4.5.3
    • libdw1-debuginfo-0.168-4.5.3
    • libebl-devel-0.168-4.5.3
    • libebl-plugins-0.168-4.5.3
    • libebl-plugins-debuginfo-0.168-4.5.3
    • libelf-devel-0.168-4.5.3
    • libelf1-0.168-4.5.3
    • libelf1-debuginfo-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15 (x86_64):
    • libdw1-32bit-0.168-4.5.3
    • libdw1-32bit-debuginfo-0.168-4.5.3
    • libebl-plugins-32bit-0.168-4.5.3
    • libebl-plugins-32bit-debuginfo-0.168-4.5.3
    • libelf1-32bit-0.168-4.5.3
    • libelf1-32bit-debuginfo-0.168-4.5.3
  • SUSE Linux Enterprise Module for Basesystem 15 (noarch):
    • elfutils-lang-0.168-4.5.3

References: