CVE-2022-47696

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

• CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS
• CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS
• CVE-2022-47696: Fix read of unitialized field which may cause a DoS

• CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS
• CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS
• CVE-2022-47696: Fix read of unitialized field which may cause a DoS

• CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS
• CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS
• CVE-2022-47696: Fix read of unitialized field which may cause a DoS

• CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS
• CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS
• CVE-2022-47696: Fix read of unitialized field which may cause a DoS

• CVE-2017-16831: Fix excessive memory allocation attempts and possible integer overflows when attempting to read a COFF binary with a corrupt symbol count
• CVE-2020-19726: Fix parsing a corrupt PE format file
• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type
• CVE-2021-46174: Fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: Fix possible heap buffer overflow in find_section_in_set() in readelf.c
• CVE-2022-45703: Combine sanity checks, calculate element counts, not word counts, fix typo
• CVE-2022-47695: Test symbol flags to exclude section and synthetic symbols before attempting to check flavour
• CVE-2022-47696: Fix uninitialised field the_bfd of asymbol
• CVE-2022-47673: Fix lack of bounds checking in vms-alpha.c

• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type
• CVE-2021-46174: Fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: Fix possible heap buffer overflow in find_section_in_set() in readelf.c
• CVE-2022-45703: Combine sanity checks, calculate element counts, not word counts, fix typo
• CVE-2022-47695: Test symbol flags to exclude section and synthetic symbols before attempting to check flavour
• CVE-2022-47696: Fix uninitialised field the_bfd of asymbol
• CVE-2022-47673: Fix lack of bounds checking in vms-alpha.c

• CVE-2022-44840: fix heap buffer overflow in find_section_in_set in dwarf.c
• CVE-2023-25584: fix lack of bounds checking in vms-alpha.c parse_module
• CVE-2022-47673: fix OOB reads in parse_module
• CVE-2022-47696: fix uninitialised the_bfd field in mach-o.c synthetic symbols
• CVE-2022-45703: fix heap buffer overflow in display_gdb_index in dwarf.c

• CVE-2022-47673: fix out-of-bounds reads in parse_module (bfd/vms-alpha.c), combined backport of upstream commits c9178f28, 942fa4fb, 77c225bd, 65cf035b and c093f5ee (patch also covers CVE-2023-25584)
• CVE-2022-47695: fix segfault in objdump compare_symbols on synthetic plt symbols
• CVE-2022-47696: fix out-of-bounds read in bfd/mach-o.c bfd_mach_o_get_synthetic_symtab

• CVE-2021-45078: fix heap-based buffer overflow in stab_xcoff_builtin_type
• CVE-2021-46174: fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: fix heap buffer overflow in find_section_in_set
• CVE-2022-45703: fix heap buffer overflow in display_gdb_index
• CVE-2022-47695: fix segmentation fault in compare_symbols
• CVE-2022-47696: fix DoS in bfd_mach_o_get_synthetic_symtab
• CVE-2022-47673: fix out-of-bounds reads in parse_module
• CVE-2025-11082: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame

These are all security issues fixed in the binutils-2.41-1.2 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

Update to version 2.41 [jsc#PED-5778]:

• The MIPS port now supports the Sony Interactive Entertainment Allegrex processor, used with the PlayStation Portable, which implements the MIPS II ISA along with a single-precision FPU and a few implementation-specific integer instructions.

• Objdump's --private option can now be used on PE format files to display the fields in the file header and section headers.

• New versioned release of libsframe: libsframe.so.1. This release introduces versioned symbols with version node name LIBSFRAME_1.0. This release also updates the ABI in an incompatible way: this includes removal of sframe_get_funcdesc_with_addr API, change in the behavior of sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.

• SFrame Version 2 is now the default (and only) format version supported by gas, ld, readelf and objdump.

• Add command-line option, --strip-section-headers, to objcopy and strip to remove ELF section header from ELF file.

• The RISC-V port now supports the following new standard extensions:

  • Zicond (conditional zero instructions)
  • Zfa (additional floating-point instructions)
  • Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng, Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)

• The RISC-V port now supports the following vendor-defined extensions:

  • XVentanaCondOps

• Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.

• A new .insn directive is recognized by x86 gas.

• Add SME2 support to the AArch64 port.

• The linker now accepts a command line option of --remap-inputs <PATTERN>=<FILE> to relace any input file that matches <PATTERN> with <FILE>. In addition the option --remap-inputs-file=<FILE> can be used to specify a file containing any number of these remapping directives.

• The linker command line option --print-map-locals can be used to include local symbols in a linker map. (ELF targets only).

• For most ELF based targets, if the --enable-linker-version option is used then the version of the linker will be inserted as a string into the .comment section.

• The linker script syntax has a new command for output sections: ASCIZ 'string' This will insert a zero-terminated string at the current location.

• Add command-line option, -z nosectionheader, to omit ELF section header.

• Contains fixes for these non-CVEs (not security bugs per upstreams SECURITY.md):

  • bsc#1209642 aka CVE-2023-1579 aka PR29988
  • bsc#1210297 aka CVE-2023-1972 aka PR30285
  • bsc#1210733 aka CVE-2023-2222 aka PR29936
  • bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  • bsc#1214565 aka CVE-2020-19726 aka PR26240
  • bsc#1214567 aka CVE-2022-35206 aka PR29290
  • bsc#1214579 aka CVE-2022-35205 aka PR29289
  • bsc#1214580 aka CVE-2022-44840 aka PR29732
  • bsc#1214604 aka CVE-2022-45703 aka PR29799
  • bsc#1214611 aka CVE-2022-48065 aka PR29925
  • bsc#1214619 aka CVE-2022-48064 aka PR29922
  • bsc#1214620 aka CVE-2022-48063 aka PR29924
  • bsc#1214623 aka CVE-2022-47696 aka PR29677
  • bsc#1214624 aka CVE-2022-47695 aka PR29846
  • bsc#1214625 aka CVE-2022-47673 aka PR29876

• Fixed a compatibility problem caused by binutils-revert-rela.diff in SLE codestreams. Needed for update of glibc as that would otherwise pick up the broken relative relocs support. [bsc#1213282, jsc#PED-1435]

• Document fixed CVEs:

  • bsc#1208037 aka CVE-2023-25588 aka PR29677
  • bsc#1208038 aka CVE-2023-25587 aka PR29846
  • bsc#1208040 aka CVE-2023-25585 aka PR29892
  • bsc#1208409 aka CVE-2023-0687 aka PR29444

• Enable bpf-none cross target and add bpf-none to the multitarget set of supported targets.

• Disable packed-relative-relocs for old codestreams. They generate buggy relocations when binutils-revert-rela.diff is active. [bsc#1206556]

• Disable ZSTD debug section compress by default.

• Enable zstd compression algorithm (instead of zlib) for debug info sections by…

This update for binutils fixes the following issues:

Update to version 2.41 [jsc#PED-5778]:

• The MIPS port now supports the Sony Interactive Entertainment Allegrex processor, used with the PlayStation Portable, which implements the MIPS II ISA along with a single-precision FPU and a few implementation-specific integer instructions.

• Objdump's --private option can now be used on PE format files to display the fields in the file header and section headers.

• New versioned release of libsframe: libsframe.so.1. This release introduces versioned symbols with version node name LIBSFRAME_1.0. This release also updates the ABI in an incompatible way: this includes removal of sframe_get_funcdesc_with_addr API, change in the behavior of sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.

• SFrame Version 2 is now the default (and only) format version supported by gas, ld, readelf and objdump.

• Add command-line option, --strip-section-headers, to objcopy and strip to remove ELF section header from ELF file.

• The RISC-V port now supports the following new standard extensions:

  • Zicond (conditional zero instructions)
  • Zfa (additional floating-point instructions)
  • Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng, Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)

• The RISC-V port now supports the following vendor-defined extensions:

  • XVentanaCondOps

• Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.

• A new .insn directive is recognized by x86 gas.

• Add SME2 support to the AArch64 port.

• The linker now accepts a command line option of --remap-inputs <PATTERN>=<FILE> to relace any input file that matches <PATTERN> with <FILE>. In addition the option --remap-inputs-file=<FILE> can be used to specify a file containing any number of these remapping directives.

• The linker command line option --print-map-locals can be used to include local symbols in a linker map. (ELF targets only).

• For most ELF based targets, if the --enable-linker-version option is used then the version of the linker will be inserted as a string into the .comment section.

• The linker script syntax has a new command for output sections: ASCIZ 'string' This will insert a zero-terminated string at the current location.

• Add command-line option, -z nosectionheader, to omit ELF section header.

• Contains fixes for these non-CVEs (not security bugs per upstreams SECURITY.md):

  • bsc#1209642 aka CVE-2023-1579 aka PR29988
  • bsc#1210297 aka CVE-2023-1972 aka PR30285
  • bsc#1210733 aka CVE-2023-2222 aka PR29936
  • bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  • bsc#1214565 aka CVE-2020-19726 aka PR26240
  • bsc#1214567 aka CVE-2022-35206 aka PR29290
  • bsc#1214579 aka CVE-2022-35205 aka PR29289
  • bsc#1214580 aka CVE-2022-44840 aka PR29732
  • bsc#1214604 aka CVE-2022-45703 aka PR29799
  • bsc#1214611 aka CVE-2022-48065 aka PR29925
  • bsc#1214619 aka CVE-2022-48064 aka PR29922
  • bsc#1214620 aka CVE-2022-48063 aka PR29924
  • bsc#1214623 aka CVE-2022-47696 aka PR29677
  • bsc#1214624 aka CVE-2022-47695 aka PR29846
  • bsc#1214625 aka CVE-2022-47673 aka PR29876

• This only existed only for a very short while in SLE-15, as the main variant in devel:gcc subsumed this in binutils-revert-rela.diff. Hence:

• Document fixed CVEs:

  • bsc#1208037 aka CVE-2023-25588 aka PR29677
  • bsc#1208038 aka CVE-2023-25587 aka PR29846
  • bsc#1208040 aka CVE-2023-25585 aka PR29892
  • bsc#1208409 aka CVE-2023-0687 aka PR29444

• Enable bpf-none cross target and add bpf-none to the multitarget set of supported targets.

• Disable packed-relative-relocs for old codestreams. They generate buggy relocations when binutils-revert-rela.diff is active. [bsc#1206556]

• Disable ZSTD debug section compress by default.

• Enable zstd compression algorithm (instead of zlib) for debug info sections by default.

• Pack libgprofng only for supported platforms.

• Move…