UbuntuUpdates.org

Package "libbinutils"

Name: libbinutils

Description:

GNU binary utilities (private shared library)
Latest version: 2.38-4ubuntu2.6
Release: jammy (22.04)
Level: security
Repository: main
Head package: binutils
Homepage: https://www.gnu.org/software/binutils/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libbinutils"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libbinutils" in Jammy

Repository Area Version
base main 2.38-3ubuntu1
updates main 2.38-4ubuntu2.6

Changelog

Version: 2.38-4ubuntu2.6 2024-02-26 11:06:57 UTC

  binutils (2.38-4ubuntu2.6) jammy-security; urgency=medium

  * SECURITY UPDATE: segmentation fault in objdump.c compare_symbols
    - debian/patches/CVE-2022-47695.patch: test symbol flags to exclude
      section and synthetic symbols before attempting to check flavour
      (compare_symbols).
    - CVE-2022-47695
  * SECURITY UPDATE: excessive memory allocation in objdump.c
    - debian/patches/CVE-2022-48063.patch: check that the amount of memory to
      be allocated matches the size of the section
      (load_specific_debug_section).
    - CVE-2022-48063
  * SECURITY UPDATE: Memory leak in find_abstract_instance in dwarf2.c
    - debian/patches/CVE-2022-48065.patch: remove memory leaks due to double
      allocation of the name variable, and free memory before re-assigning a
      new naming variable
    - CVE-2022-48065

 -- Nick Galanis <email address hidden> Tue, 23 Jan 2024 15:08:56 +0000
Source diff to previous version
CVE-2022-47695 An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_ma
CVE-2022-48063 GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2
CVE-2022-48065 GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

Version: 2.38-4ubuntu2.5 2024-01-15 14:06:54 UTC

  binutils (2.38-4ubuntu2.5) jammy-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in dwarf.c
    - debian/patches/CVE-2022-44840.patch: delete range check (end_cu_tu_entry
      and add_shndx_to_cu_tu_entry) and fill shndx_pool by directly scanning
      pool, rather than indirectly from index entries (process_cu_tu_index).
    - CVE-2022-44840
  * SECURITY UPDATE: heap buffer overflow in dwarf.c
    - debian/patches/CVE-2022-45703-0.patch: combine sanity checks. Calculate
      element counts, not word counts (display_gdb_index).
    - debian/patches/CVE-2022-45703-1.patch: typo fix.
    - CVE-2022-45703
  * SECURITY UPDATE: memory leak in stabs.c
    - debian/patches/CVE-2022-47007.patch: free dt on failure path
      (stab_demangle_v3_arg).
    - CVE-2022-47007
  * SECURITY UPDATE: memory leak in bucomm.c
    - debian/patches/CVE-2022-47008.patch: free template on all failure paths
      (make_tempdir, make_tempname).
    - CVE-2022-47008
  * SECURITY UPDATE: memory leak in prdbg.c
    - debian/patches/CVE-2022-47010.patch: free "s" on failure path
      (pr_function_type).
    - CVE-2022-47010
  * SECURITY UPDATE: memory leak in stabs.c
    - debian/patches/CVE-2022-47011.patch: free "fields" on failure path
      (parse_stab_struct_fields).
    - CVE-2022-47011

 -- Nick Galanis <email address hidden> Wed, 03 Jan 2024 13:16:50 +0200
Source diff to previous version
CVE-2022-44840 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
CVE-2022-45703 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.
CVE-2022-47007 An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to mem
CVE-2022-47008 An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of servic
CVE-2022-47010 An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory
CVE-2022-47011 An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to

Version: 2.38-4ubuntu2.4 2023-12-11 13:08:59 UTC

  binutils (2.38-4ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: reachable assertion failure in dwarf.c
    - debian/patches/CVE-2022-35205.patch: replace assert with a warning
      message (display_debug_names).
    - CVE-2022-35205

  * SECURITY UPDATE: illegal memory access flaw in elf.c while parsing an
    ELF file
    - debian/patches/CVE-2022-4285.patch: Fix an illegal memory access when
      parsing an ELF file containing corrupt symbol version information.
    - CVE-2022-4285

 -- Nick Galanis <email address hidden> Mon, 04 Dec 2023 10:57:50 +0000
Source diff to previous version
CVE-2022-35205 An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial o
CVE-2022-4285 An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a de

Version: 2.38-4ubuntu2.3 2023-07-31 17:07:10 UTC

  binutils (2.38-4ubuntu2.3) jammy-proposed; urgency=medium

  * SRU: LP: #2022845. Update from the binutils 2.38 branch:
    - Fix PR ld/29435: elf: Reset alignment for each PT_LOAD segment.
    - PowerPC64 pcrel got relocs against local symbols.
    - Fix PR ld/27998: i386: Don't allow GOTOFF relocation against
      IFUNC symbol for PIC.
    - Fix PR ld/29377: x86: Properly check invalid relocation against
      protected symbol.
  * Ignore lto-wrapper warnings when running the testsuite.

 -- Matthias Klose <email address hidden> Sun, 04 Jun 2023 08:49:40 +0200
Source diff to previous version
2022845 SRU: update binutils to the 2.38 branch and ignore lto-wrapper warnings

Version: 2.38-4ubuntu2.2 2023-05-24 11:07:01 UTC

  binutils (2.38-4ubuntu2.2) jammy-security; urgency=medium

  * SECURITY UPDATE: heap-based buffer overflow vulnerability
    - debian/patches/CVE-2023-1972.patch: Fix an illegal memory access
      when an accessing a zer0-lengthverdef table.
    - CVE-2023-1972
  * SECURITY UPDATE: out-of-bound read vulnerability
    - debian/patches/CVE-2023-25584.patch: Lack of bounds checking in
      vms-alpha.c parse_module
    - CVE-2023-25584
  * SECURITY UPDATE: segmentation fault due to uninitialized `file_table`
    - debian/patches/CVE-2023-25585.patch: Use bfd_zmalloc to alloc
      file_table
    - CVE-2023-25585
  * SECURITY UPDATE: segmentation fault due to uninitialized `the_bfd`
    - debian/patches/CVE-2023-25588.patch: Field `the_bfd` of `asymbol` is
      uninitialised
    - CVE-2023-25588

 -- Nishit Majithia <email address hidden> Mon, 22 May 2023 12:48:33 +0530
CVE-2023-1972 A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.
CVE-2023-25584 RESERVED
CVE-2023-25585 RESERVED
CVE-2023-25588 RESERVED


About   -   Send Feedback to @ubuntu_updates