CVE-2023-1972

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

The GNU Binutils are a collection of binary tools. The main ones are: ld - the GNU linker. as - the GNU assembler. addr2line - Converts addresses into filenames and line numbers. ar - A utility for creating, modifying and extracting from archives. c++filt - Filter to demangle encoded C++ symbols. dlltool - Creates files for building and using DLLs. gold - A new, faster, ELF only linker, still in beta test. gprof - Displays profiling information. nlmconv - Converts object code into an NLM. nm - Lists symbols from object files. objcopy - Copies and translates object files. objdump - Displays information from object files. ranlib - Generates an index to the contents of an archive. readelf - Displays information from any ELF format object file. size - Lists the section sizes of an object or archive file. strings - Lists printable strings from files. trip - Discards symbols. windmc - A Windows compatible message compiler. windres - A compiler for Windows resource files.

Security Fix(es):

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.(CVE-2022-4285)

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.(CVE-2022-48064)

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.(CVE-2023-1972)

The GNU Binutils are a collection of binary tools. The main ones are: ld - the GNU linker. as - the GNU assembler. addr2line - Converts addresses into filenames and line numbers. ar - A utility for creating, modifying and extracting from archives. c++filt - Filter to demangle encoded C++ symbols. dlltool - Creates files for building and using DLLs. gold - A new, faster, ELF only linker, still in beta test. gprof - Displays profiling information. nlmconv - Converts object code into an NLM. nm - Lists symbols from object files. objcopy - Copies and translates object files. objdump - Displays information from object files. ranlib - Generates an index to the contents of an archive. readelf - Displays information from any ELF format object file. size - Lists the section sizes of an object or archive file. strings - Lists printable strings from files. trip - Discards symbols. windmc - A Windows compatible message compiler. windres - A compiler for Windows resource files.

Security Fix(es):

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.(CVE-2022-4285)

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.(CVE-2022-48064)

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.(CVE-2023-1972)

The GNU Binutils are a collection of binary tools. The main ones are: ld - the GNU linker. as - the GNU assembler. addr2line - Converts addresses into filenames and line numbers. ar - A utility for creating, modifying and extracting from archives. c++filt - Filter to demangle encoded C++ symbols. dlltool - Creates files for building and using DLLs. gold - A new, faster, ELF only linker, still in beta test. gprof - Displays profiling information. nlmconv - Converts object code into an NLM. nm - Lists symbols from object files. objcopy - Copies and translates object files. objdump - Displays information from object files. ranlib - Generates an index to the contents of an archive. readelf - Displays information from any ELF format object file. size - Lists the section sizes of an object or archive file. strings - Lists printable strings from files. trip - Discards symbols. windmc - A Windows compatible message compiler. windres - A compiler for Windows resource files.

Security Fix(es):

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.(CVE-2022-4285)

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.(CVE-2022-48064)

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.(CVE-2023-1972)

Root has patched CVE-2023-1972 in the binutils package for Root:Debian:12. Multiple fixed versions available.

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

• CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables
• CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry
• CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols
• CVE-2025-11839: fix abort in tg_tag_type with fuzzed input
• CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing
• CVE-2025-3198: fix memory leak in objdump display_info
• CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF
• CVE-2025-69652: fix abort in readelf from malformed DWARF debug info
• CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing

• CVE-2022-38533: fix heap buffer overflow in bfd_getl32 from strip_main with crafted COFF file
• CVE-2022-47007: fix memory leak in stab_demangle_v3_arg in stabs.c
• CVE-2022-47008: fix memory leak in make_tempdir and make_tempname in bucomm.c
• CVE-2022-47010: fix memory leak in pr_function_type in prdbg.c
• CVE-2022-48064: fix excessive memory consumption in bfd_dwarf2_find_nearest_line_with_alt
• CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. (CVE-2022-4285) A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. (CVE-2023-1972) GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. (CVE-2023-39128) GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. (CVE-2023-39129) GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. (CVE-2023-39130)

These are all security issues fixed in the binutils-2.41-1.2 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

Update to version 2.41 [jsc#PED-5778]:

• The MIPS port now supports the Sony Interactive Entertainment Allegrex processor, used with the PlayStation Portable, which implements the MIPS II ISA along with a single-precision FPU and a few implementation-specific integer instructions.

• Objdump's --private option can now be used on PE format files to display the fields in the file header and section headers.

• New versioned release of libsframe: libsframe.so.1. This release introduces versioned symbols with version node name LIBSFRAME_1.0. This release also updates the ABI in an incompatible way: this includes removal of sframe_get_funcdesc_with_addr API, change in the behavior of sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.

• SFrame Version 2 is now the default (and only) format version supported by gas, ld, readelf and objdump.

• Add command-line option, --strip-section-headers, to objcopy and strip to remove ELF section header from ELF file.

• The RISC-V port now supports the following new standard extensions:

  • Zicond (conditional zero instructions)
  • Zfa (additional floating-point instructions)
  • Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng, Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)

• The RISC-V port now supports the following vendor-defined extensions:

  • XVentanaCondOps

• Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.

• A new .insn directive is recognized by x86 gas.

• Add SME2 support to the AArch64 port.

• The linker now accepts a command line option of --remap-inputs <PATTERN>=<FILE> to relace any input file that matches <PATTERN> with <FILE>. In addition the option --remap-inputs-file=<FILE> can be used to specify a file containing any number of these remapping directives.

• The linker command line option --print-map-locals can be used to include local symbols in a linker map. (ELF targets only).

• For most ELF based targets, if the --enable-linker-version option is used then the version of the linker will be inserted as a string into the .comment section.

• The linker script syntax has a new command for output sections: ASCIZ 'string' This will insert a zero-terminated string at the current location.

• Add command-line option, -z nosectionheader, to omit ELF section header.

• Contains fixes for these non-CVEs (not security bugs per upstreams SECURITY.md):

  • bsc#1209642 aka CVE-2023-1579 aka PR29988
  • bsc#1210297 aka CVE-2023-1972 aka PR30285
  • bsc#1210733 aka CVE-2023-2222 aka PR29936
  • bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  • bsc#1214565 aka CVE-2020-19726 aka PR26240
  • bsc#1214567 aka CVE-2022-35206 aka PR29290
  • bsc#1214579 aka CVE-2022-35205 aka PR29289
  • bsc#1214580 aka CVE-2022-44840 aka PR29732
  • bsc#1214604 aka CVE-2022-45703 aka PR29799
  • bsc#1214611 aka CVE-2022-48065 aka PR29925
  • bsc#1214619 aka CVE-2022-48064 aka PR29922
  • bsc#1214620 aka CVE-2022-48063 aka PR29924
  • bsc#1214623 aka CVE-2022-47696 aka PR29677
  • bsc#1214624 aka CVE-2022-47695 aka PR29846
  • bsc#1214625 aka CVE-2022-47673 aka PR29876

• Fixed a compatibility problem caused by binutils-revert-rela.diff in SLE codestreams. Needed for update of glibc as that would otherwise pick up the broken relative relocs support. [bsc#1213282, jsc#PED-1435]

• Document fixed CVEs:

  • bsc#1208037 aka CVE-2023-25588 aka PR29677
  • bsc#1208038 aka CVE-2023-25587 aka PR29846
  • bsc#1208040 aka CVE-2023-25585 aka PR29892
  • bsc#1208409 aka CVE-2023-0687 aka PR29444

• Enable bpf-none cross target and add bpf-none to the multitarget set of supported targets.

• Disable packed-relative-relocs for old codestreams. They generate buggy relocations when binutils-revert-rela.diff is active. [bsc#1206556]

• Disable ZSTD debug section compress by default.

• Enable zstd compression algorithm (instead of zlib) for debug info sections by…

This update for binutils fixes the following issues:

Update to version 2.41 [jsc#PED-5778]:

• The MIPS port now supports the Sony Interactive Entertainment Allegrex processor, used with the PlayStation Portable, which implements the MIPS II ISA along with a single-precision FPU and a few implementation-specific integer instructions.

• Objdump's --private option can now be used on PE format files to display the fields in the file header and section headers.

• New versioned release of libsframe: libsframe.so.1. This release introduces versioned symbols with version node name LIBSFRAME_1.0. This release also updates the ABI in an incompatible way: this includes removal of sframe_get_funcdesc_with_addr API, change in the behavior of sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.

• SFrame Version 2 is now the default (and only) format version supported by gas, ld, readelf and objdump.

• Add command-line option, --strip-section-headers, to objcopy and strip to remove ELF section header from ELF file.

• The RISC-V port now supports the following new standard extensions:

  • Zicond (conditional zero instructions)
  • Zfa (additional floating-point instructions)
  • Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng, Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)

• The RISC-V port now supports the following vendor-defined extensions:

  • XVentanaCondOps

• Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.

• A new .insn directive is recognized by x86 gas.

• Add SME2 support to the AArch64 port.

• The linker now accepts a command line option of --remap-inputs <PATTERN>=<FILE> to relace any input file that matches <PATTERN> with <FILE>. In addition the option --remap-inputs-file=<FILE> can be used to specify a file containing any number of these remapping directives.

• The linker command line option --print-map-locals can be used to include local symbols in a linker map. (ELF targets only).

• For most ELF based targets, if the --enable-linker-version option is used then the version of the linker will be inserted as a string into the .comment section.

• The linker script syntax has a new command for output sections: ASCIZ 'string' This will insert a zero-terminated string at the current location.

• Add command-line option, -z nosectionheader, to omit ELF section header.

• Contains fixes for these non-CVEs (not security bugs per upstreams SECURITY.md):

  • bsc#1209642 aka CVE-2023-1579 aka PR29988
  • bsc#1210297 aka CVE-2023-1972 aka PR30285
  • bsc#1210733 aka CVE-2023-2222 aka PR29936
  • bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  • bsc#1214565 aka CVE-2020-19726 aka PR26240
  • bsc#1214567 aka CVE-2022-35206 aka PR29290
  • bsc#1214579 aka CVE-2022-35205 aka PR29289
  • bsc#1214580 aka CVE-2022-44840 aka PR29732
  • bsc#1214604 aka CVE-2022-45703 aka PR29799
  • bsc#1214611 aka CVE-2022-48065 aka PR29925
  • bsc#1214619 aka CVE-2022-48064 aka PR29922
  • bsc#1214620 aka CVE-2022-48063 aka PR29924
  • bsc#1214623 aka CVE-2022-47696 aka PR29677
  • bsc#1214624 aka CVE-2022-47695 aka PR29846
  • bsc#1214625 aka CVE-2022-47673 aka PR29876

• This only existed only for a very short while in SLE-15, as the main variant in devel:gcc subsumed this in binutils-revert-rela.diff. Hence:

• Document fixed CVEs:

  • bsc#1208037 aka CVE-2023-25588 aka PR29677
  • bsc#1208038 aka CVE-2023-25587 aka PR29846
  • bsc#1208040 aka CVE-2023-25585 aka PR29892
  • bsc#1208409 aka CVE-2023-0687 aka PR29444

• Enable bpf-none cross target and add bpf-none to the multitarget set of supported targets.

• Disable packed-relative-relocs for old codestreams. They generate buggy relocations when binutils-revert-rela.diff is active. [bsc#1206556]

• Disable ZSTD debug section compress by default.

• Enable zstd compression algorithm (instead of zlib) for debug info sections by default.

• Pack libgprofng only for supported platforms.

• Move…

It was discovered that GNU binutils incorrectly handled certain DWARF files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 22.10. (CVE-2023-1579)

It was discovered that GNU binutils did not properly verify the version definitions in zer0-lengthverdef table. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-1972)

It was discovered that GNU binutils did not properly validate the size of length parameter in vms-alpha. An attacker could possibly use this issue to cause a crash or access sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2023-25584)

It was discovered that GNU binutils did not properly initialized the file_table field of struct module and the_bfd field of asymbol. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-25585, CVE-2023-25588)

It was discovered that gdb incorrectly handled certain memory operations when parsing an ELF file. An attacker could possibly use this issue to cause a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-4285)

It was discovered that gdb incorrectly handled memory leading to a heap based buffer overflow. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-1972)

It was discovered that gdb incorrectly handled memory leading to a stack overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-39128)

It was discovered that gdb had a use after free vulnerability under certain circumstances. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-39129)

It was discovered that gdb incorrectly handled memory leading to a heap based buffer overflow. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-39130)