binutils has been updated to fix eight security issues :

  - Lack of range checking leading to controlled write in
    _bfd_elf_setup_sections(). (CVE-2014-8485)

  - Invalid read flaw in libbfd. (CVE-2014-8484)

  - Write to uninitialized memory in the PE parser.
    (CVE-2014-8501)

  - Crash in the PE parser. (CVE-2014-8502)

  - Segfault in the ihex parser when it encounters a     malformed ihex file. (CVE-2014-8503)

  - Stack buffer overflow in srec_scan. (CVE-2014-8504)

  - Out-of-bounds memory write while processing a crafted     'ar' archive. (CVE-2014-8738)

  - Directory traversal vulnerability allowing random file     deletion/creation. (CVE-2014-8737)

Multiple vulnerabilities has been found and corrected in binutils :

Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the addition of CHUNK_HEADER_SIZE to the length, which triggers a heap-based buffer overflow (CVE-2012-3509).

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record (CVE-2014-8484).

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file (CVE-2014-8485).

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable (CVE-2014-8501).

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file (CVE-2014-8502).

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file (CVE-2014-8503).

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file (CVE-2014-8504).

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar (CVE-2014-8737).

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive (CVE-2014-8738).

The updated packages provides a solution for these security issues.

Multiple security issues have been found in binutils, a toolbox for binary file manipulation. These vulnerabilities include multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions, path traversal attack or denial of service.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information.(CVE-2018-7568)

  - A stack-based buffer overflow flaw was found in the way     various binutils utilities processed certain files. If     a user were tricked into processing a specially crafted     file, it could cause the utility used to process that     file to crash or, potentially, execute arbitrary code     with the privileges of the user running that     utility.(CVE-2014-8501)

  - The coff_slurp_line_table function in coffcode.h in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.29.1, allows remote     attackers to cause a denial of service (invalid memory     access and application crash) or possibly have     unspecified other impact via a crafted PE     file.(CVE-2017-16826)

  - It was found that the fix for the CVE-2014-8485 issue     was incomplete: a heap-based buffer overflow in the     objdump utility could cause it to crash or,     potentially, execute arbitrary code with the privileges     of the user running objdump when processing specially     crafted files.(CVE-2014-8502)

  - A directory traversal flaw was found in the strip and     objcopy utilities. A specially crafted file could cause     strip or objdump to overwrite an arbitrary file     writable by the user running either of these     utilities.(CVE-2014-8737)

  - The bfd_section_from_shdr function in elf.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (segmentation     fault) via a large attribute section.(CVE-2018-8945)

  - In the coff_pointerize_aux function in coffgen.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, an index is not     validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF     object.(CVE-2018-7208)

  - dwarf1.c in the Binary File Descriptor (BFD) library     (aka libbfd), as distributed in GNU Binutils 2.29,     mishandles pointers, which allows remote attackers to     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     ELF file, related to parse_die and parse_line_table, as     demonstrated by a parse_die heap-based buffer     over-read.(CVE-2017-15020)

  - A buffer overflow flaw was found in the way various     binutils utilities processed certain files. If a user     were tricked into processing a specially crafted file,     it could cause the utility used to process that file to     crash or, potentially, execute arbitrary code with the     privileges of the user running that     utility.(CVE-2014-8485)

  - An integer overflow flaw was found in the way the     strings utility processed certain files. If a user were     tricked into running the strings utility on a specially     crafted file, it could cause the strings executable to     crash.(CVE-2014-8484)

  - A heap-based buffer overflow flaw was found in the way     certain binutils utilities processed archive files. If     a user were tricked into processing a specially crafted     archive file, it could cause the utility used to     process that archive to crash or, potentially, execute     arbitrary code with the privileges of the user running     that utility.(CVE-2014-8738)

  - The swap_std_reloc_in function in aoutx.h in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference     and application crash) via a crafted ELF file, as     demonstrated by objcopy.(CVE-2018-7642)

  - The display_debug_frames function in dwarf.c in GNU     Binutils 2.29.1 allows remote attackers to cause a     denial of service (integer overflow and heap-based     buffer over-read, and application crash) or possibly     have unspecified other impact via a crafted ELF file,     related to print_debug_frame.(CVE-2017-16828)

  - A stack-based buffer overflow flaw was found in the     SREC parser of the libbfd library. A specially crafted     file could cause an application using the libbfd     library to crash or, potentially, execute arbitrary     code with the privileges of the user running that     application.(CVE-2014-8504)

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information.(CVE-2018-7569)

  - A stack-based buffer overflow flaw was found in the way     objdump processed IHEX files. A specially crafted IHEX     file could cause objdump to crash or, potentially,     execute arbitrary code with the privileges of the user     running objdump.(CVE-2014-8503)

  - coffgen.c in the Binary File Descriptor (BFD) library     (aka libbfd), as distributed in GNU Binutils 2.29.1,     does not validate the symbol count, which allows remote     attackers to cause a denial of service (integer     overflow and application crash, or excessive memory     allocation) or possibly have unspecified other impact     via a crafted PE file.(CVE-2017-16831)

  - The aout_get_external_symbols function in aoutx.h in     the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.29.1, allows remote     attackers to cause a denial of service (slurp_symtab     invalid free and application crash) or possibly have     unspecified other impact via a crafted ELF     file.(CVE-2017-16827)

  - The display_debug_ranges function in dwarf.c in GNU     Binutils 2.30 allows remote attackers to cause a denial     of service (integer overflow and application crash) or     possibly have unspecified other impact via a crafted     ELF file, as demonstrated by objdump.(CVE-2018-7643)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils through 2.31. There is an integer overflow and     infinite loop caused by the IS_CONTAINED_BY_LMA macro     in elf.c.(CVE-2018-19932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

已在用于二进制文件操纵的工具箱 binutils 中发现多个安全问题。这些漏洞包括多个内存安全错误、缓冲区溢出、释放后使用以及其他可导致执行任意代码、绕过安全限制、路径遍历攻击或拒绝服务的实现错误。

binutils 已更新，修复了八个安全问题：

- 缺少范围检查导致控制
 _bfd_elf_setup_sections() 中的写入。(CVE-2014-8485)

- libbfd 中的无效读取缺陷。(CVE-2014-8484)

- 将未初始化内存写入 PE 解析器。
 (CVE-2014-8501)

- PE 解析器中崩溃。(CVE-2014-8502)

- 遇到畸形 ihex 文件时 ihex 解析器中的段错误。(CVE-2014-8503)

- srec_scan 中的堆栈缓冲区溢出。(CVE-2014-8504)

- 处理构建的“ar”存档时的越界内存写入。(CVE-2014-8738)

- 允许随机文件删除/创建的目录遍历漏洞。(CVE-2014-8737)

已在 binutils 中发现并修正了多种漏洞：

在 (1) objalloc.c 的 _objalloc_alloc 函数中以及 (2) GNU libiberty 内 include/objalloc.h 的 objalloc_alloc 宏中存在多种整数溢出，被 binutils 2.22 使用时，允许远程攻击者通过与 CHUNK_HEADER_SIZE 添加到长度相关、可触发基于堆的缓冲区溢出的矢量造成拒绝服务（崩溃）(CVE-2012-3509)。

在 2.25 之前的 GNU binutils 中，bfd/srec.c 中的 srec_scan 函数允许远程攻击者通过小 S-record 造成拒绝服务（越界读取）(CVE-2014-8484)。

在 GNU binutils 2.24 及更早版本的 libbfd 中，bfd/elf.c 中的 setup_group 函数允许远程攻击者通过 ELF 文件中构建的文档段组标头造成拒绝服务（崩溃）并可能执行任意代码 (CVE-2014-8485)。

在 GNU binutils 2.24 及更早版本的 bfd/peXXigen.c 中的 _bfd_XXi_swap_aouthdr_in 函数允许远程攻击者通过 PE 可执行文件中构建的 AOUT 标头中的 NumberOfRvaAndSizes 字段造成拒绝服务（越界写入）并可能造成其他不明影响 (CVE-2014-8501)。

在 GNU binutils 2.24 及更早版本的 bfd/peXXigen.c 中的 pe_print_edata 函数存在基于堆的缓冲区溢出，允许远程攻击者通过 PE 文件中截断的导出表造成拒绝服务（崩溃）并可能造成其他不明影响 (CVE-2014-8502)。

GNU binutils 2.24 及更早版本的 bfd/ihex.c 中的 ihex_scan 函数存在基于堆栈的缓冲区溢出，允许远程攻击者通过构建的 ihex 文件造成拒绝服务（崩溃）并可能造成其他不明影响 (CVE-2014-8503)。

GNU binutils 2.24 及更早版本的 bfd/srec.c 中的 srec_scan 函数存在基于堆栈的缓冲区溢出，允许远程攻击者通过构建的文件造成拒绝服务（崩溃）并可能造成其他不明影响 (CVE-2014-8504)。

GNU binutils 2.24 及更早版本中存在多种目录遍历漏洞，允许本地用户通过(1) strip 或 (2) objcopy 存档中的 ..（点点）或完整路径名称删除任意文件，或者通过 (3) ar 存档中的 ..（点点）或完整路径名称创建任意文件 (CVE-2014-8737)。

GNU binutils 2.24 及更早版本的 bfd/archive.c 中的 _bfd_slurp_extended_name_table 函数，允许远程攻击者通过存档中构建的扩展名称表造成拒绝服务（无效的写入、分段错误和崩溃）(CVE-2014-8738)。

更新后的程序包提供针对这些安全问题的解决方案。

已在用于二进制文件操纵的工具箱 binutils 中发现多个安全问题。这些漏洞包括多个内存安全错误、缓冲区溢出、释放后使用以及其他可导致执行任意代码、绕过安全限制、路径遍历攻击或拒绝服务的实现错误。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

来自 Red Hat 安全公告 2015:2079：

更新后的 binutils 程序包修复了多种安全问题和多个缺陷并添加了多种增强，现在可用于 Red Hat Enterprise Linux 7。

Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

binutils 程序包提供一系列二进制实用工具。

发现各 binutils 实用工具所使用的 libbdf 库存在多种缓冲区溢出缺陷。如果用户受到诱骗，在应用程序中使用 libbdf 库处理特别构建的文件，则可能导致该应用程序崩溃，或执行任意代码。（CVE-2014-8485、CVE-2014-8501、CVE-2014-8502、CVE-2014-8503、CVE-2014-8504、CVE-2014-8738）

在各 binutils 实用工具所使用的 libbdf 库中发现整数溢出缺陷。如果用户受到诱骗，在应用程序中使用 libbdf 库处理特别构建的文件，则可能导致该应用程序崩溃。(CVE-2014-8484)

在 strip 和 objcopy 实用工具中发现目录遍历缺陷。特别构建的文件可导致 strip 或 objdump 对运行其中任何实用工具的用户具备写入权限的任意文件进行覆盖。(CVE-2014-8737)

此更新修复了以下缺陷：

* 对于由系统加载程序启动的二进制文件而言，即使在构建应用程序时对其进行明确的请求，仍可能缺少重定位只读 (RELRO)保护。已在多种架构中修复此缺陷。应重新构建使用 binutils 的 alpha 或 beta 版本构建的应用程序及所有依存对象文件、存档和库，以修正此缺陷。（BZ#1200138、BZ#1175624）

* 64 位 PowerPC 中的 ld 链接器在接收到非 PowerPC 格式二进制的生成请求时，现在能够正确检查输出格式。
(BZ#1226864)

* 已持久化为正在调试的二进制保留符号表的重要变量，且 64 位 PowerPC 上的 objdump 实用工具现已可以访问所需信息，而不会读取无效的内存区域。(BZ#1172766)

* RHBA-2015:0974 中描述的不良运行时重定位。
(BZ#872148)

此更新添加了以下增强：

* 组装器、拆装器和链接器现已支持 IBM z Systems z13 的新硬件指令以及单一指令和多个数据 (SIMD) 指令。(BZ#1182153)

*“FUNC@localentry”形式的表达式用于表示 FUNC 函数（如果已定义）的本地入口点，现由 PowerPC 组装器支持。这些是 IBM Power 系统的 little-endian 变体中的 ELFv2 ABI 所必需的。(BZ#1194164)

建议所有 binutils 用户升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序，并添加了这些增强。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
81076	SuSE 11.3 Security Update : binutils (SAT Patch Number 10214)	Nessus	SuSE Local Security Checks	2015/1/29	2021/1/6	high
81195	Mandriva Linux Security Advisory : binutils (MDVSA-2015:029-1)	Nessus	Mandriva Local Security Checks	2015/2/6	2021/1/6	high
82301	Debian DLA-184-1 : binutils security update	Nessus	Debian Local Security Checks	2015/3/30	2021/1/11	high
124934	EulerOS Virtualization 3.0.1.0 : binutils (EulerOS-SA-2019-1431)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
80444	Debian DSA-3123-1：binutils - 安全更新	Nessus	Debian Local Security Checks	2015/1/12	2021/1/11	high
81076	SuSE 11.3 安全更新：binutils（SAT 修补程序编号 10214）	Nessus	SuSE Local Security Checks	2015/1/29	2021/1/6	high
81195	Mandriva Linux 安全公告：binutils (MDVSA-2015:029-1)	Nessus	Mandriva Local Security Checks	2015/2/6	2021/1/6	high
82301	Debian DLA-184-1：binutils 安全更新	Nessus	Debian Local Security Checks	2015/3/30	2021/1/11	high
87018	Oracle Linux 7：binutils (ELSA-2015-2079)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2021/1/14	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high