Security update for binutils SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1475-1 Final 1 1 2021-11-15T09:07:38Z current 2021-11-15T09:07:38Z 2021-11-15T09:07:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for binutils This update for binutils fixes the following issues: Update to binutils 2.37: * The GNU Binutils sources now requires a C99 compiler and library to build. * Support for Realm Management Extension (RME) for AArch64 has been added. * A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations. * A new linker option '-z start-stop-gc' has been added to disable special treatment of __start_*/__stop_* references when --gc-sections. * A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options. * The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16. * A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else. * A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools. * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols. * Readelf and objdump can now display and use the contents of .debug_sup sections. * Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option. The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed. If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file *will* be displayed. This is because in most cases the debug section will only be present in one of the files. If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will *not* be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files. * Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic. Update to binutils 2.36: New features in the Assembler: - General: * When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name. * Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active. * Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically. - X86/x86_64: * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions. * Support non-absolute segment values for lcall and ljmp. * Add {disp16} pseudo prefix to x86 assembler. * Configure with --enable-x86-used-note by default for Linux/x86. - ARM/AArch64: * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1, Cortex-R82, Neoverse V1, and Neoverse N2 cores. * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call Stack Recorder Extension) and BRBE (Branch Record Buffer Extension) system registers. * Add support for Armv8-R and Armv8.7-A ISA extensions. * Add support for DSB memory nXS barrier, WFET and WFIT instruction for Armv8.7. * Add support for +csre feature for -march. Add CSR PDEC instruction for CSRE feature in AArch64. * Add support for +flagm feature for -march in Armv8.4 AArch64. * Add support for +ls64 feature for -march in Armv8.7 AArch64. Add atomic 64-byte load/store instructions for this feature. * Add support for +pauth (Pointer Authentication) feature for -march in AArch64. New features in the Linker: * Add --error-handling-script=<NAME> command line option to allow a helper script to be invoked when an undefined symbol or a missing library is encountered. This option can be suppressed via the configure time switch: --enable-error-handling-script=no. * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark x86-64-{baseline|v[234]} ISA level as needed. * Add -z unique-symbol to avoid duplicated local symbol names. * The creation of PE format DLLs now defaults to using a more secure set of DLL characteristics. * The linker now deduplicates the types in .ctf sections. The new command-line option --ctf-share-types describes how to do this: its default value, share-unconflicted, produces the most compact output. * The linker now omits the 'variable section' from .ctf sections by default, saving space. This is almost certainly what you want unless you are working on a project that has its own analogue of symbol tables that are not reflected in the ELF symtabs. New features in other binary tools: * The ar tool's previously unused l modifier is now used for specifying dependencies of a static library. The arguments of this option (or --record-libdeps long form option) will be stored verbatim in the __.LIBDEP member of the archive, which the linker may read at link time. * Readelf can now display the contents of LTO symbol table sections when asked to do so via the --lto-syms command line option. * Readelf now accepts the -C command line option to enable the demangling of symbol names. In addition the --demangle=<style>, --no-demangle, --recurse-limit and --no-recurse-limit options are also now availale. Other fixes: - For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now. - Fixed that ppc64 optflags did not enable LTO (bsc#1188941). - Fix empty man-pages from broken release tarball - Fixed a memory corruption with rpath option (bsc#1191473). - Fixed slow performance of stripping some binaries (bsc#1183909). The following security fixes are addressed by the update: - CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452). - CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (bsc#1183511). - CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory consumption in bfd's dwarf2.c read_section() (bsc#1184620). - CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794). - CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898). - CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899). - CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900). - CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901). - CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902). - CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903) - CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c via crafted PEF file (bsc#1180451). - CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value of bfd_malloc (bsc#1180454). - CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461). - CVE-2021-20294: Fixed out-of-bounds write in print_dynamic_symbol in readelf (bnc#1184519) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1475 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ E-Mail link for openSUSE-SU-2021:1475-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179898 SUSE Bug 1179898 https://bugzilla.suse.com/1179899 SUSE Bug 1179899 https://bugzilla.suse.com/1179900 SUSE Bug 1179900 https://bugzilla.suse.com/1179901 SUSE Bug 1179901 https://bugzilla.suse.com/1179902 SUSE Bug 1179902 https://bugzilla.suse.com/1179903 SUSE Bug 1179903 https://bugzilla.suse.com/1180451 SUSE Bug 1180451 https://bugzilla.suse.com/1180454 SUSE Bug 1180454 https://bugzilla.suse.com/1180461 SUSE Bug 1180461 https://bugzilla.suse.com/1181452 SUSE Bug 1181452 https://bugzilla.suse.com/1182252 SUSE Bug 1182252 https://bugzilla.suse.com/1183511 SUSE Bug 1183511 https://bugzilla.suse.com/1183909 SUSE Bug 1183909 https://bugzilla.suse.com/1184519 SUSE Bug 1184519 https://bugzilla.suse.com/1184620 SUSE Bug 1184620 https://bugzilla.suse.com/1184794 SUSE Bug 1184794 https://bugzilla.suse.com/1188941 SUSE Bug 1188941 https://bugzilla.suse.com/1191473 SUSE Bug 1191473 https://bugzilla.suse.com/1192267 SUSE Bug 1192267 https://www.suse.com/security/cve/CVE-2020-16590/ SUSE CVE CVE-2020-16590 page https://www.suse.com/security/cve/CVE-2020-16591/ SUSE CVE CVE-2020-16591 page https://www.suse.com/security/cve/CVE-2020-16592/ SUSE CVE CVE-2020-16592 page https://www.suse.com/security/cve/CVE-2020-16593/ SUSE CVE CVE-2020-16593 page https://www.suse.com/security/cve/CVE-2020-16598/ SUSE CVE CVE-2020-16598 page https://www.suse.com/security/cve/CVE-2020-16599/ SUSE CVE CVE-2020-16599 page https://www.suse.com/security/cve/CVE-2020-35448/ SUSE CVE CVE-2020-35448 page https://www.suse.com/security/cve/CVE-2020-35493/ SUSE CVE CVE-2020-35493 page https://www.suse.com/security/cve/CVE-2020-35496/ SUSE CVE CVE-2020-35496 page https://www.suse.com/security/cve/CVE-2020-35507/ SUSE CVE CVE-2020-35507 page https://www.suse.com/security/cve/CVE-2021-20197/ SUSE CVE CVE-2021-20197 page https://www.suse.com/security/cve/CVE-2021-20284/ SUSE CVE CVE-2021-20284 page https://www.suse.com/security/cve/CVE-2021-20294/ SUSE CVE CVE-2021-20294 page https://www.suse.com/security/cve/CVE-2021-3487/ SUSE CVE CVE-2021-3487 page openSUSE Leap 15.2 binutils-2.37-lp152.4.9.1 binutils-devel-2.37-lp152.4.9.1 binutils-devel-32bit-2.37-lp152.4.9.1 binutils-gold-2.37-lp152.4.9.1 bpftrace-0.11.4-lp152.2.7.1 bpftrace-tools-0.11.4-lp152.2.7.1 cross-aarch64-binutils-2.37-lp152.4.9.1 cross-arm-binutils-2.37-lp152.4.9.1 cross-avr-binutils-2.37-lp152.4.9.1 cross-epiphany-binutils-2.37-lp152.4.9.1 cross-hppa-binutils-2.37-lp152.4.9.1 cross-hppa64-binutils-2.37-lp152.4.9.1 cross-i386-binutils-2.37-lp152.4.9.1 cross-ia64-binutils-2.37-lp152.4.9.1 cross-m68k-binutils-2.37-lp152.4.9.1 cross-mips-binutils-2.37-lp152.4.9.1 cross-ppc-binutils-2.37-lp152.4.9.1 cross-ppc64-binutils-2.37-lp152.4.9.1 cross-ppc64le-binutils-2.37-lp152.4.9.1 cross-riscv64-binutils-2.37-lp152.4.9.1 cross-rx-binutils-2.37-lp152.4.9.1 cross-s390-binutils-2.37-lp152.4.9.1 cross-s390x-binutils-2.37-lp152.4.9.1 cross-sparc-binutils-2.37-lp152.4.9.1 cross-sparc64-binutils-2.37-lp152.4.9.1 cross-spu-binutils-2.37-lp152.4.9.1 cross-xtensa-binutils-2.37-lp152.4.9.1 libctf-nobfd0-2.37-lp152.4.9.1 libctf0-2.37-lp152.4.9.1 binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 binutils-devel-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 binutils-devel-32bit-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 binutils-gold-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 bpftrace-0.11.4-lp152.2.7.1 as a component of openSUSE Leap 15.2 bpftrace-tools-0.11.4-lp152.2.7.1 as a component of openSUSE Leap 15.2 cross-aarch64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-arm-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-avr-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-epiphany-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-hppa-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-hppa64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-i386-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-ia64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-m68k-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-mips-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-ppc-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-ppc64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-ppc64le-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-riscv64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-rx-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-s390-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-s390x-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-sparc-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-sparc64-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-spu-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 cross-xtensa-binutils-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 libctf-nobfd0-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 libctf0-2.37-lp152.4.9.1 as a component of openSUSE Leap 15.2 A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file. CVE-2020-16590 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16590.html CVE-2020-16590 https://bugzilla.suse.com/1179898 SUSE Bug 1179898 A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif. CVE-2020-16591 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16591.html CVE-2020-16591 https://bugzilla.suse.com/1179899 SUSE Bug 1179899 A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file. CVE-2020-16592 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16592.html CVE-2020-16592 https://bugzilla.suse.com/1179900 SUSE Bug 1179900 A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file. CVE-2020-16593 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16593.html CVE-2020-16593 https://bugzilla.suse.com/1179901 SUSE Bug 1179901 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2020-16598 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16598.html CVE-2020-16598 https://bugzilla.suse.com/1179902 SUSE Bug 1179902 A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file. CVE-2020-16599 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-16599.html CVE-2020-16599 https://bugzilla.suse.com/1179903 SUSE Bug 1179903 https://bugzilla.suse.com/1206080 SUSE Bug 1206080 An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. CVE-2020-35448 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-35448.html CVE-2020-35448 https://bugzilla.suse.com/1184794 SUSE Bug 1184794 A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. CVE-2020-35493 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-35493.html CVE-2020-35493 https://bugzilla.suse.com/1180451 SUSE Bug 1180451 There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. CVE-2020-35496 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-35496.html CVE-2020-35496 https://bugzilla.suse.com/1180454 SUSE Bug 1180454 There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. CVE-2020-35507 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2020-35507.html CVE-2020-35507 https://bugzilla.suse.com/1180461 SUSE Bug 1180461 There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. CVE-2021-20197 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 3.3 AV:L/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2021-20197.html CVE-2021-20197 https://bugzilla.suse.com/1181452 SUSE Bug 1181452 A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability. CVE-2021-20284 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2021-20284.html CVE-2021-20284 https://bugzilla.suse.com/1183511 SUSE Bug 1183511 A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability. CVE-2021-20294 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2021-20294.html CVE-2021-20294 https://bugzilla.suse.com/1184519 SUSE Bug 1184519 https://bugzilla.suse.com/1196680 SUSE Bug 1196680 ** REJECT ** Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt CVE-2021-3487 openSUSE Leap 15.2:binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-devel-32bit-2.37-lp152.4.9.1 openSUSE Leap 15.2:binutils-gold-2.37-lp152.4.9.1 openSUSE Leap 15.2:bpftrace-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:bpftrace-tools-0.11.4-lp152.2.7.1 openSUSE Leap 15.2:cross-aarch64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-arm-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-avr-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-epiphany-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-hppa64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-i386-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ia64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-m68k-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-mips-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-ppc64le-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-riscv64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-rx-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-s390x-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-sparc64-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-spu-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:cross-xtensa-binutils-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf-nobfd0-2.37-lp152.4.9.1 openSUSE Leap 15.2:libctf0-2.37-lp152.4.9.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N6RYWEZ5BKTK6UEP6HAB7B466BPC3SMJ/ https://www.suse.com/security/cve/CVE-2021-3487.html CVE-2021-3487 https://bugzilla.suse.com/1184620 SUSE Bug 1184620