Security update for binutils SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:2432-1 Final 1 1 2019-11-05T15:30:18Z current 2019-11-05T15:30:18Z 2019-11-05T15:30:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for binutils This update for binutils fixes the following issues: binutils was updated to current 2.32 branch [jsc#ECO-368]. Includes following security fixes: - CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412) - CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413) - CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414) - CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827) - CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996) - CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535) - CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534) - CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255) - CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252) - CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247) - CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831) - CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830) - CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035) - CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034) - CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in load_specific_debug_section in objdump.c (bsc#1121056) - CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640) - CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772) - enable xtensa architecture (Tensilica lc6 and related) - Use -ffat-lto-objects in order to provide assembly for static libs (bsc#1141913). - Fixed some LTO build issues (bsc#1133131 bsc#1133232). - riscv: Don't check ABI flags if no code section - Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016). - Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590). Update to binutils 2.32: * The binutils now support for the C-SKY processor series. * The x86 assembler now supports a -mvexwig=[0|1] option to control encoding of VEX.W-ignored (WIG) VEX instructions. It also has a new -mx86-used-note=[yes|no] option to generate (or not) x86 GNU property notes. * The MIPS assembler now supports the Loongson EXTensions R2 (EXT2), the Loongson EXTensions (EXT) instructions, the Loongson Content Address Memory (CAM) ASE and the Loongson MultiMedia extensions Instructions (MMI) ASE. * The addr2line, c++filt, nm and objdump tools now have a default limit on the maximum amount of recursion that is allowed whilst demangling strings. This limit can be disabled if necessary. * Objdump's --disassemble option can now take a parameter, specifying the starting symbol for disassembly. Disassembly will continue from this symbol up to the next symbol or the end of the function. * The BFD linker will now report property change in linker map file when merging GNU properties. * The BFD linker's -t option now doesn't report members within archives, unless -t is given twice. This makes it more useful when generating a list of files that should be packaged for a linker bug report. * The GOLD linker has improved warning messages for relocations that refer to discarded sections. - Improve relro support on s390 [fate#326356] - Fix broken debug symbols (bsc#1118644) - Handle ELF compressed header alignment correctly. This update was imported from the SUSE:SLE-15-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-2432 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html E-Mail link for openSUSE-SU-2019:2432-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109412 SUSE Bug 1109412 https://bugzilla.suse.com/1109413 SUSE Bug 1109413 https://bugzilla.suse.com/1109414 SUSE Bug 1109414 https://bugzilla.suse.com/1111996 SUSE Bug 1111996 https://bugzilla.suse.com/1112534 SUSE Bug 1112534 https://bugzilla.suse.com/1112535 SUSE Bug 1112535 https://bugzilla.suse.com/1113247 SUSE Bug 1113247 https://bugzilla.suse.com/1113252 SUSE Bug 1113252 https://bugzilla.suse.com/1113255 SUSE Bug 1113255 https://bugzilla.suse.com/1116827 SUSE Bug 1116827 https://bugzilla.suse.com/1118644 SUSE Bug 1118644 https://bugzilla.suse.com/1118830 SUSE Bug 1118830 https://bugzilla.suse.com/1118831 SUSE Bug 1118831 https://bugzilla.suse.com/1120640 SUSE Bug 1120640 https://bugzilla.suse.com/1121034 SUSE Bug 1121034 https://bugzilla.suse.com/1121035 SUSE Bug 1121035 https://bugzilla.suse.com/1121056 SUSE Bug 1121056 https://bugzilla.suse.com/1133131 SUSE Bug 1133131 https://bugzilla.suse.com/1133232 SUSE Bug 1133232 https://bugzilla.suse.com/1141913 SUSE Bug 1141913 https://bugzilla.suse.com/1142772 SUSE Bug 1142772 https://bugzilla.suse.com/1152590 SUSE Bug 1152590 https://bugzilla.suse.com/1154016 SUSE Bug 1154016 https://bugzilla.suse.com/1154025 SUSE Bug 1154025 https://www.suse.com/security/cve/CVE-2018-1000876/ SUSE CVE CVE-2018-1000876 page https://www.suse.com/security/cve/CVE-2018-17358/ SUSE CVE CVE-2018-17358 page https://www.suse.com/security/cve/CVE-2018-17359/ SUSE CVE CVE-2018-17359 page https://www.suse.com/security/cve/CVE-2018-17360/ SUSE CVE CVE-2018-17360 page https://www.suse.com/security/cve/CVE-2018-17985/ SUSE CVE CVE-2018-17985 page https://www.suse.com/security/cve/CVE-2018-18309/ SUSE CVE CVE-2018-18309 page https://www.suse.com/security/cve/CVE-2018-18483/ SUSE CVE CVE-2018-18483 page https://www.suse.com/security/cve/CVE-2018-18484/ SUSE CVE CVE-2018-18484 page https://www.suse.com/security/cve/CVE-2018-18605/ SUSE CVE CVE-2018-18605 page https://www.suse.com/security/cve/CVE-2018-18606/ SUSE CVE CVE-2018-18606 page https://www.suse.com/security/cve/CVE-2018-18607/ SUSE CVE CVE-2018-18607 page https://www.suse.com/security/cve/CVE-2018-19931/ SUSE CVE CVE-2018-19931 page https://www.suse.com/security/cve/CVE-2018-19932/ SUSE CVE CVE-2018-19932 page https://www.suse.com/security/cve/CVE-2018-20623/ SUSE CVE CVE-2018-20623 page https://www.suse.com/security/cve/CVE-2018-20651/ SUSE CVE CVE-2018-20651 page https://www.suse.com/security/cve/CVE-2018-20671/ SUSE CVE CVE-2018-20671 page https://www.suse.com/security/cve/CVE-2018-6323/ SUSE CVE CVE-2018-6323 page https://www.suse.com/security/cve/CVE-2018-6543/ SUSE CVE CVE-2018-6543 page https://www.suse.com/security/cve/CVE-2018-6759/ SUSE CVE CVE-2018-6759 page https://www.suse.com/security/cve/CVE-2018-6872/ SUSE CVE CVE-2018-6872 page https://www.suse.com/security/cve/CVE-2018-7208/ SUSE CVE CVE-2018-7208 page https://www.suse.com/security/cve/CVE-2018-7568/ SUSE CVE CVE-2018-7568 page https://www.suse.com/security/cve/CVE-2018-7569/ SUSE CVE CVE-2018-7569 page https://www.suse.com/security/cve/CVE-2018-7570/ SUSE CVE CVE-2018-7570 page https://www.suse.com/security/cve/CVE-2018-7642/ SUSE CVE CVE-2018-7642 page https://www.suse.com/security/cve/CVE-2018-7643/ SUSE CVE CVE-2018-7643 page https://www.suse.com/security/cve/CVE-2018-8945/ SUSE CVE CVE-2018-8945 page https://www.suse.com/security/cve/CVE-2019-1010180/ SUSE CVE CVE-2019-1010180 page openSUSE Leap 15.1 binutils-2.32-lp151.3.3.1 binutils-devel-2.32-lp151.3.3.1 binutils-devel-32bit-2.32-lp151.3.3.1 binutils-gold-2.32-lp151.3.3.1 cross-aarch64-binutils-2.32-lp151.3.3.1 cross-arm-binutils-2.32-lp151.3.3.1 cross-avr-binutils-2.32-lp151.3.3.1 cross-epiphany-binutils-2.32-lp151.3.3.1 cross-hppa-binutils-2.32-lp151.3.3.1 cross-hppa64-binutils-2.32-lp151.3.3.1 cross-i386-binutils-2.32-lp151.3.3.1 cross-ia64-binutils-2.32-lp151.3.3.1 cross-m68k-binutils-2.32-lp151.3.3.1 cross-mips-binutils-2.32-lp151.3.3.1 cross-ppc-binutils-2.32-lp151.3.3.1 cross-ppc64-binutils-2.32-lp151.3.3.1 cross-ppc64le-binutils-2.32-lp151.3.3.1 cross-riscv64-binutils-2.32-lp151.3.3.1 cross-rx-binutils-2.32-lp151.3.3.1 cross-s390-binutils-2.32-lp151.3.3.1 cross-s390x-binutils-2.32-lp151.3.3.1 cross-sparc-binutils-2.32-lp151.3.3.1 cross-sparc64-binutils-2.32-lp151.3.3.1 cross-spu-binutils-2.32-lp151.3.3.1 binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 binutils-devel-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 binutils-devel-32bit-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 binutils-gold-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-aarch64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-arm-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-avr-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-epiphany-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-hppa-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-hppa64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-i386-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-ia64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-m68k-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-mips-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-ppc-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-ppc64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-ppc64le-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-riscv64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-rx-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-s390-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-s390x-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-sparc-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-sparc64-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 cross-spu-binutils-2.32-lp151.3.3.1 as a component of openSUSE Leap 15.1 binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. CVE-2018-1000876 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-1000876.html CVE-2018-1000876 https://bugzilla.suse.com/1120640 SUSE Bug 1120640 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. CVE-2018-17358 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-17358.html CVE-2018-17358 https://bugzilla.suse.com/1109412 SUSE Bug 1109412 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. CVE-2018-17359 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-17359.html CVE-2018-17359 https://bugzilla.suse.com/1109413 SUSE Bug 1109413 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. CVE-2018-17360 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-17360.html CVE-2018-17360 https://bugzilla.suse.com/1109414 SUSE Bug 1109414 An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters. CVE-2018-17985 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-17985.html CVE-2018-17985 https://bugzilla.suse.com/1116827 SUSE Bug 1116827 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash, which leads to denial of service, as demonstrated by objdump, because of missing _bfd_clear_contents bounds checking. CVE-2018-18309 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18309.html CVE-2018-18309 https://bugzilla.suse.com/1111996 SUSE Bug 1111996 The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt. CVE-2018-18483 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18483.html CVE-2018-18483 https://bugzilla.suse.com/1112535 SUSE Bug 1112535 An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type. CVE-2018-18484 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18484.html CVE-2018-18484 https://bugzilla.suse.com/1112534 SUSE Bug 1112534 A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18605 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18605.html CVE-2018-18605 https://bugzilla.suse.com/1113255 SUSE Bug 1113255 An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18606 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18606.html CVE-2018-18606 https://bugzilla.suse.com/1113252 SUSE Bug 1113252 An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-18607 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-18607.html CVE-2018-18607 https://bugzilla.suse.com/1113247 SUSE Bug 1113247 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. CVE-2018-19931 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-19931.html CVE-2018-19931 https://bugzilla.suse.com/1118830 SUSE Bug 1118830 https://bugzilla.suse.com/1118831 SUSE Bug 1118831 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c. CVE-2018-19932 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-19932.html CVE-2018-19932 https://bugzilla.suse.com/1118830 SUSE Bug 1118830 https://bugzilla.suse.com/1118831 SUSE Bug 1118831 In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file. CVE-2018-20623 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-20623.html CVE-2018-20623 https://bugzilla.suse.com/1121035 SUSE Bug 1121035 A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld. CVE-2018-20651 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-20651.html CVE-2018-20651 https://bugzilla.suse.com/1121034 SUSE Bug 1121034 load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size. CVE-2018-20671 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-20671.html CVE-2018-20671 https://bugzilla.suse.com/1121056 SUSE Bug 1121056 The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-6323 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-6323.html CVE-2018-6323 https://bugzilla.suse.com/1077745 SUSE Bug 1077745 In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-6543 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-6543.html CVE-2018-6543 https://bugzilla.suse.com/1079103 SUSE Bug 1079103 The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file. CVE-2018-6759 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-6759.html CVE-2018-6759 https://bugzilla.suse.com/1079741 SUSE Bug 1079741 The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment. CVE-2018-6872 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-6872.html CVE-2018-6872 https://bugzilla.suse.com/1080556 SUSE Bug 1080556 In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object. CVE-2018-7208 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7208.html CVE-2018-7208 https://bugzilla.suse.com/1081527 SUSE Bug 1081527 The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm. CVE-2018-7568 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7568.html CVE-2018-7568 https://bugzilla.suse.com/1086788 SUSE Bug 1086788 dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. CVE-2018-7569 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7569.html CVE-2018-7569 https://bugzilla.suse.com/1083532 SUSE Bug 1083532 The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy. CVE-2018-7570 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7570.html CVE-2018-7570 https://bugzilla.suse.com/1083528 SUSE Bug 1083528 The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy. CVE-2018-7642 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7642.html CVE-2018-7642 https://bugzilla.suse.com/1086786 SUSE Bug 1086786 https://bugzilla.suse.com/1128518 SUSE Bug 1128518 The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump. CVE-2018-7643 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-7643.html CVE-2018-7643 https://bugzilla.suse.com/1086784 SUSE Bug 1086784 The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section. CVE-2018-8945 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2018-8945.html CVE-2018-8945 https://bugzilla.suse.com/1086608 SUSE Bug 1086608 GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet. CVE-2019-1010180 openSUSE Leap 15.1:binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-devel-32bit-2.32-lp151.3.3.1 openSUSE Leap 15.1:binutils-gold-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-aarch64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-arm-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-avr-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-epiphany-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-hppa64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-i386-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ia64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-m68k-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-mips-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-ppc64le-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-riscv64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-rx-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-s390x-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-sparc64-binutils-2.32-lp151.3.3.1 openSUSE Leap 15.1:cross-spu-binutils-2.32-lp151.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html https://www.suse.com/security/cve/CVE-2019-1010180.html CVE-2019-1010180 https://bugzilla.suse.com/1142772 SUSE Bug 1142772