CVE-2017-16829

The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.

The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.

These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gdb-12.1-6.1 package on the GA media of openSUSE Tumbleweed.

This update for binutils to version 2.31 fixes the following issues:

These security issues were fixed:

• CVE-2017-15996: readelf allowed remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggered a buffer overflow on fuzzed archive header (bsc#1065643)
• CVE-2017-15939: Binary File Descriptor (BFD) library (aka libbfd) mishandled NULL files in a .debug_line file table, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename (bsc#1065689)
• CVE-2017-15938: the Binary File Descriptor (BFD) library (aka libbfd) miscalculated DW_FORM_ref_addr die refs in the case of a relocatable object file, which allowed remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash) (bsc#1065693)
• CVE-2017-16826: The coff_slurp_line_table function the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068640)
• CVE-2017-16832: The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate size and offset values in the data dictionary, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068643)
• CVE-2017-16831: Binary File Descriptor (BFD) library (aka libbfd) did not validate the symbol count, which allowed remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file (bsc#1068887)
• CVE-2017-16830: The print_gnu_property_note function did not have integer-overflow protection on 32-bit platforms, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068888)
• CVE-2017-16829: The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library (aka libbfd) did not prevent negative pointers, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068950)
• CVE-2017-16828: The display_debug_frames function allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069176)
• CVE-2017-16827: The aout_get_external_symbols function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069202)
• CVE-2018-6323: The elf_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) had an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1077745)
• CVE-2018-6543: Prevent integer overflow in the function load_specific_debug_section() which resulted in malloc() with 0 size. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1079103)
• CVE-2018-6759: The bfd_get_debug_link_info_1 function in the Binary File Descriptor (BFD) library (aka libbfd) had an unchecked strnlen operation. Remote attackers could have…

This update for binutils to 2.31 fixes the following issues:

These security issues were fixed:

• CVE-2017-15996: readelf allowed remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggered a buffer overflow on fuzzed archive header (bsc#1065643).
• CVE-2017-15939: Binary File Descriptor (BFD) library (aka libbfd) mishandled NULL files in a .debug_line file table, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename (bsc#1065689).
• CVE-2017-15938: the Binary File Descriptor (BFD) library (aka libbfd) miscalculated DW_FORM_ref_addr die refs in the case of a relocatable object file, which allowed remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash) (bsc#1065693).
• CVE-2017-16826: The coff_slurp_line_table function the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068640).
• CVE-2017-16832: The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate size and offset values in the data dictionary, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068643).
• CVE-2017-16831: Binary File Descriptor (BFD) library (aka libbfd) did not validate the symbol count, which allowed remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file (bsc#1068887).
• CVE-2017-16830: The print_gnu_property_note function did not have integer-overflow protection on 32-bit platforms, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068888).
• CVE-2017-16829: The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library (aka libbfd) did not prevent negative pointers, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068950).
• CVE-2017-16828: The display_debug_frames function allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069176).
• CVE-2017-16827: The aout_get_external_symbols function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069202).
• CVE-2018-6323: The elf_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) had an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1077745).
• CVE-2018-6543: Prevent integer overflow in the function load_specific_debug_section() which resulted in malloc() with 0 size. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1079103).
• CVE-2018-6759: The bfd_get_debug_link_info_1 function in the Binary File Descriptor (BFD) library (aka libbfd) had an unchecked strnlen operation. Remote attackers could have…

This update for binutils to 2.31 fixes the following issues:

These security issues were fixed:

• CVE-2017-15996: readelf allowed remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggered a buffer overflow on fuzzed archive header (bsc#1065643).
• CVE-2017-15939: Binary File Descriptor (BFD) library (aka libbfd) mishandled NULL files in a .debug_line file table, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename (bsc#1065689).
• CVE-2017-15938: the Binary File Descriptor (BFD) library (aka libbfd) miscalculated DW_FORM_ref_addr die refs in the case of a relocatable object file, which allowed remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash) (bsc#1065693).
• CVE-2017-16826: The coff_slurp_line_table function the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068640).
• CVE-2017-16832: The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library (aka libbfd) did not validate size and offset values in the data dictionary, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file (bsc#1068643).
• CVE-2017-16831: Binary File Descriptor (BFD) library (aka libbfd) did not validate the symbol count, which allowed remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file (bsc#1068887).
• CVE-2017-16830: The print_gnu_property_note function did not have integer-overflow protection on 32-bit platforms, which allowed remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068888).
• CVE-2017-16829: The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library (aka libbfd) did not prevent negative pointers, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1068950).
• CVE-2017-16828: The display_debug_frames function allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069176).
• CVE-2017-16827: The aout_get_external_symbols function in the Binary File Descriptor (BFD) library (aka libbfd) allowed remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file (bsc#1069202).
• CVE-2018-6323: The elf_object_p function in the Binary File Descriptor (BFD) library (aka libbfd) had an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1077745).
• CVE-2018-6543: Prevent integer overflow in the function load_specific_debug_section() which resulted in malloc() with 0 size. A crafted ELF file allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (bsc#1079103).
• CVE-2018-6759: The bfd_get_debug_link_info_1 function in the Binary File Descriptor (BFD) library (aka libbfd) had an unchecked strnlen operation. Remote attackers could have…

This update for gdb fixes the following issues:

gdb was updated to 12.1. (jsc#SLE-21561)

• DBX mode is deprecated, and will be removed in GDB 13.

• GDB 12 is the last release of GDB that will support building against Python 2. From GDB 13, it will only be possible to build GDB itself with Python 3 support.

• Improved C++ template support:

  GDB now treats functions/types involving C++ templates like it does function overloads. Users may omit parameter lists to set breakpoints on families of template functions, including types/functions composed of multiple template types: (gdb) break template_func(template_1, int) The above will set breakpoints at every function template_func' where the first function parameter is any template type named template_1' and the second function parameter is `int'. TAB completion also gains similar improvements.

• New commands:

  • maint set backtrace-on-fatal-signal on|off
  • maint show backtrace-on-fatal-signal

  This setting is 'on' by default. When 'on' GDB will print a limited backtrace to stderr in the situation where GDB terminates with a fatal signal. This only supported on some platforms where the backtrace and backtrace_symbols_fd functions are available.

  • set source open on|off
  • show source open

  This setting, which is on by default, controls whether GDB will try to open source code files. Switching this off will stop GDB trying to open and read source code files, which can be useful if the files are located over a slow network connection.

  • set varsize-limit
  • show varsize-limit

  These are now deprecated aliases for 'set max-value-size' and 'show max-value-size'.

  • task apply [all | TASK-IDS...] [FLAG]... COMMAND

  Like 'thread apply', but applies COMMAND to Ada tasks.

  • watch [...] task ID

  Watchpoints can now be restricted to a specific Ada task.

  • maint set internal-error backtrace on|off
  • maint show internal-error backtrace
  • maint set internal-warning backtrace on|off
  • maint show internal-warning backtrace

  GDB can now print a backtrace of itself when it encounters either an internal-error, or an internal-warning. This is on by default for internal-error and off by default for internal-warning.

  • set logging on|off

  Deprecated and replaced by 'set logging enabled on|off'.

  • set logging enabled on|off
  • show logging enabled

  These commands set or show whether logging is enabled or disabled.

  • exit

  You can now exit GDB by using the new command 'exit', in addition to the existing 'quit' command.

  • set debug threads on|off
  • show debug threads

  Print additional debug messages about thread creation and deletion.

  • set debug linux-nat on|off
  • show debug linux-nat

  These new commands replaced the old 'set debug lin-lwp' and 'show debug lin-lwp' respectively. Turning this setting on prints debug messages relating to GDB's handling of native Linux inferiors.

  • maint flush source-cache

  Flush the contents of the source code cache.

  • maint set gnu-source-highlight enabled on|off
  • maint show gnu-source-highlight enabled

  Whether GDB should use the GNU Source Highlight library for adding styling to source code. When off, the library will not be used, even when available. When GNU Source Highlight isn't used, or can't add styling to a particular source file, then the Python Pygments library will be used instead.

  • set suppress-cli-notifications (on|off)
  • show suppress-cli-notifications

  This controls whether printing the notifications is suppressed for CLI. CLI notifications occur when you change the selected context (i.e., the current inferior, thread and/or the frame), or when the program being debugged stops (e.g., because of hitting a breakpoint, completing source-stepping, an interrupt, etc.).

  • set style disassembler enabled on|off
  • show style disassembler enabled

  If GDB is compiled with Python support, and the…

This update for gdb fixes the following issues:

• Drop libdebuginfod1 BuildRequires/Recommends. The former isn't needed because there's a build requirement on libdebuginfod-devel already, which will pull the shared library. And the latter, because it's bogus since RPM auto generated dependency will take care of that requirement.

gdb was released in 13.2:

• This version of GDB includes the following changes and enhancements:

  • Support for the following new targets has been added in both GDB and GDBserver:

    * GNU/Linux/LoongArch (gdbserver) loongarch*-*-linux*
    * GNU/Linux/CSKY (gdbserver) csky*-*linux* 
    

  • The Windows native target now supports target async.

  • Floating-point support has now been added on LoongArch GNU/Linux.

  • New commands:

    * set print nibbles [on|off]
    * show print nibbles
    
    * This controls whether the 'print/t' command will display binary values in groups of four bits, known as 'nibbles'. The default is 'off'.
      Various styling-related commands. See the gdb/NEWS file for more details.
      Various maintenance commands. These are normally aimed at GDB experts or developers. See the gdb/NEWS file for more details. 
    

  • Python API improvements:

      * New Python API for instruction disassembly.
    
      * The new attribute 'locations' of gdb.Breakpoint returns a list of gdb.BreakpointLocation objects specifying the locations where the breakpoint is inserted into the debuggee.
      * New Python type gdb.BreakpointLocation.
      * New function gdb.format_address(ADDRESS, PROGSPACE, ARCHITECTURE) that formats ADDRESS as 'address '
      * New function gdb.current_language that returns the name of the current language. Unlike gdb.parameter('language'), this will never return 'auto'.
      * New function gdb.print_options that returns a dictionary of the prevailing print options, in the form accepted by gdb.Value.format_string.
      * New method gdb.Frame.language that returns the name of the frame's language.
      * gdb.Value.format_string now uses the format provided by 'print', if it is called during a 'print' or other similar operation.
      * gdb.Value.format_string now accepts the 'summary' keyword. This can be used to request a shorter representation of a value, the way that 'set print frame-arguments scalars' does.
      * The gdb.register_window_type method now restricts the set of acceptable window names. The first character of a window's name must start with a character in the set [a-zA-Z], every subsequent character of a window's name must be in the set [-_.a-zA-Z0-9]. 
    

  • GDB/MI changes:

     * MI version 1 is deprecated, and will be removed in GDB 14.
     * The async record stating the stopped reason 'breakpoint-hit' now contains an optional field locno. 
    

  • Miscellaneous improvements:

     * gdb now supports zstd compressed debug sections (ELFCOMPRESS_ZSTD) for ELF.
     * New convenience variable $_inferior_thread_count contains the number of live threads in the current inferior.
     * New convenience variables $_hit_bpnum and $_hit_locno, set to the breakpoint number and the breakpoint location number of the breakpoint last hit.
     * The 'info breakpoints' now displays enabled breakpoint locations of disabled breakpoints as in the 'y-' state.
     * The format of 'disassemble /r' and 'record instruction-history /r' has changed to match the layout of GNU objdump when disassembling.
    
     * A new format '/b' has been introduce to provide the old behavior of '/r'.
     * The TUI no longer styles the source and assembly code highlighted by the current position indicator by default. You can however re-enable styling using the new 'set style tui-current-position' command.
     * It is now possible to use the 'document' command to document user-defined commands.
     * Support for memory tag data for AArch64 MTE. 
    

  *…

This update for gdb fixes the following issues:

• Drop libdebuginfod1 BuildRequires/Recommends. The former isn't needed because there's a build requirement on libdebuginfod-devel already, which will pull the shared library. And the latter, because it's bogus since RPM auto generated dependency will take care of that requirement.

gdb was released in 13.2:

• This version of GDB includes the following changes and enhancements:

  • Support for the following new targets has been added in both GDB and GDBserver:

    * GNU/Linux/LoongArch (gdbserver) loongarch*-*-linux*
    * GNU/Linux/CSKY (gdbserver) csky*-*linux* 
    

  • The Windows native target now supports target async.

  • Floating-point support has now been added on LoongArch GNU/Linux.

  • New commands:

    * set print nibbles [on|off]
    * show print nibbles
    
    * This controls whether the 'print/t' command will display binary values in groups of four bits, known as 'nibbles'. The default is 'off'.
      Various styling-related commands. See the gdb/NEWS file for more details.
      Various maintenance commands. These are normally aimed at GDB experts or developers. See the gdb/NEWS file for more details. 
    

  • Python API improvements:

      * New Python API for instruction disassembly.
    
      * The new attribute 'locations' of gdb.Breakpoint returns a list of gdb.BreakpointLocation objects specifying the locations where the breakpoint is inserted into the debuggee.
      * New Python type gdb.BreakpointLocation.
      * New function gdb.format_address(ADDRESS, PROGSPACE, ARCHITECTURE) that formats ADDRESS as 'address '
      * New function gdb.current_language that returns the name of the current language. Unlike gdb.parameter('language'), this will never return 'auto'.
      * New function gdb.print_options that returns a dictionary of the prevailing print options, in the form accepted by gdb.Value.format_string.
      * New method gdb.Frame.language that returns the name of the frame's language.
      * gdb.Value.format_string now uses the format provided by 'print', if it is called during a 'print' or other similar operation.
      * gdb.Value.format_string now accepts the 'summary' keyword. This can be used to request a shorter representation of a value, the way that 'set print frame-arguments scalars' does.
      * The gdb.register_window_type method now restricts the set of acceptable window names. The first character of a window's name must start with a character in the set [a-zA-Z], every subsequent character of a window's name must be in the set [-_.a-zA-Z0-9]. 
    

  • GDB/MI changes:

     * MI version 1 is deprecated, and will be removed in GDB 14.
     * The async record stating the stopped reason 'breakpoint-hit' now contains an optional field locno. 
    

  • Miscellaneous improvements:

     * gdb now supports zstd compressed debug sections (ELFCOMPRESS_ZSTD) for ELF.
     * New convenience variable $_inferior_thread_count contains the number of live threads in the current inferior.
     * New convenience variables $_hit_bpnum and $_hit_locno, set to the breakpoint number and the breakpoint location number of the breakpoint last hit.
     * The 'info breakpoints' now displays enabled breakpoint locations of disabled breakpoints as in the 'y-' state.
     * The format of 'disassemble /r' and 'record instruction-history /r' has changed to match the layout of GNU objdump when disassembling.
    
     * A new format '/b' has been introduce to provide the old behavior of '/r'.
     * The TUI no longer styles the source and assembly code highlighted by the current position indicator by default. You can however re-enable styling using the new 'set style tui-current-position' command.
     * It is now possible to use the 'document' command to document user-defined commands.
     * Support for memory tag data for AArch64 MTE. 
    

  *…

This update for gdb fixes the following issues:

• Drop libdebuginfod1 BuildRequires/Recommends. The former isn't needed because there's a build requirement on libdebuginfod-devel already, which will pull the shared library. And the latter, because it's bogus since RPM auto generated dependency will take care of that requirement.

gdb was released in 13.2:

• This version of GDB includes the following changes and enhancements:

  • Support for the following new targets has been added in both GDB and GDBserver:

    * GNU/Linux/LoongArch (gdbserver) loongarch*-*-linux*
    * GNU/Linux/CSKY (gdbserver) csky*-*linux* 
    

  • The Windows native target now supports target async.

  • Floating-point support has now been added on LoongArch GNU/Linux.

  • New commands:

    * set print nibbles [on|off]
    * show print nibbles
    
    * This controls whether the 'print/t' command will display binary values in groups of four bits, known as 'nibbles'. The default is 'off'.
      Various styling-related commands. See the gdb/NEWS file for more details.
      Various maintenance commands. These are normally aimed at GDB experts or developers. See the gdb/NEWS file for more details. 
    

  • Python API improvements:

      * New Python API for instruction disassembly.
    
      * The new attribute 'locations' of gdb.Breakpoint returns a list of gdb.BreakpointLocation objects specifying the locations where the breakpoint is inserted into the debuggee.
      * New Python type gdb.BreakpointLocation.
      * New function gdb.format_address(ADDRESS, PROGSPACE, ARCHITECTURE) that formats ADDRESS as 'address '
      * New function gdb.current_language that returns the name of the current language. Unlike gdb.parameter('language'), this will never return 'auto'.
      * New function gdb.print_options that returns a dictionary of the prevailing print options, in the form accepted by gdb.Value.format_string.
      * New method gdb.Frame.language that returns the name of the frame's language.
      * gdb.Value.format_string now uses the format provided by 'print', if it is called during a 'print' or other similar operation.
      * gdb.Value.format_string now accepts the 'summary' keyword. This can be used to request a shorter representation of a value, the way that 'set print frame-arguments scalars' does.
      * The gdb.register_window_type method now restricts the set of acceptable window names. The first character of a window's name must start with a character in the set [a-zA-Z], every subsequent character of a window's name must be in the set [-_.a-zA-Z0-9]. 
    

  • GDB/MI changes:

     * MI version 1 is deprecated, and will be removed in GDB 14.
     * The async record stating the stopped reason 'breakpoint-hit' now contains an optional field locno. 
    

  • Miscellaneous improvements:

     * gdb now supports zstd compressed debug sections (ELFCOMPRESS_ZSTD) for ELF.
     * New convenience variable $_inferior_thread_count contains the number of live threads in the current inferior.
     * New convenience variables $_hit_bpnum and $_hit_locno, set to the breakpoint number and the breakpoint location number of the breakpoint last hit.
     * The 'info breakpoints' now displays enabled breakpoint locations of disabled breakpoints as in the 'y-' state.
     * The format of 'disassemble /r' and 'record instruction-history /r' has changed to match the layout of GNU objdump when disassembling.
    
     * A new format '/b' has been introduce to provide the old behavior of '/r'.
     * The TUI no longer styles the source and assembly code highlighted by the current position indicator by default. You can however re-enable styling using the new 'set style tui-current-position' command.
     * It is now possible to use the 'document' command to document user-defined commands.
     * Support for memory tag data for AArch64 MTE. 
    

  *…