CVE-2019-14250

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

• SECURITY UPDATE:
  • CVE-*.patch: backported many upstream patches to fix security issues.
  • CVE-2016-2226, CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131, CVE-2016-4491, CVE-2017-6965, CVE-2017-6966, CVE-2017-6969, CVE-2017-7209, CVE-2017-7210, CVE-2017-7223, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2017-7299, CVE-2017-7300, CVE-2017-7301, CVE-2017-7302, CVE-2017-7614, CVE-2017-8393, CVE-2017-8394, CVE-2017-8395, CVE-2017-8397, CVE-2017-8396, CVE-2017-8398, CVE-2017-8421, CVE-2017-9038, CVE-2017-9039, CVE-2017-9040, CVE-2017-9042, CVE-2017-9041, CVE-2017-9044, CVE-2017-9742, CVE-2017-9744, CVE-2017-9752, CVE-2017-9745, CVE-2017-9746, CVE-2017-9747, CVE-2017-9748, CVE-2017-9749, CVE-2017-9750, CVE-2017-9751, CVE-2017-9753, CVE-2017-9754, CVE-2017-9755, CVE-2017-9756, CVE-2017-9954, CVE-2017-12448, CVE-2017-12449, CVE-2017-12455, CVE-2017-12457, CVE-2017-12458, CVE-2017-12459, CVE-2017-12450, CVE-2017-12452, CVE-2017-12453, CVE-2017-12454, CVE-2017-12456, CVE-2017-14333, CVE-2017-12451, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710, CVE-2017-14128, CVE-2017-14129, CVE-2017-14130, CVE-2017-14529, CVE-2017-14930, CVE-2017-14932, CVE-2017-14938, CVE-2017-14939, CVE-2017-14940, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022, CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938, CVE-2017-15939, CVE-2017-15996, CVE-2017-16826, CVE-2017-16827, CVE-2017-16828, CVE-2017-16831, CVE-2017-16832, CVE-2017-17080, CVE-2017-17121, CVE-2017-17123, CVE-2017-17124, CVE-2018-6323, CVE-2018-6543, CVE-2018-6759, CVE-2018-7208, CVE-2018-7568, CVE-2018-7569, CVE-2018-7642, CVE-2018-7643, CVE-2018-8945, CVE-2018-13033, CVE-2018-9138, CVE-2018-12641, CVE-2018-12697, CVE-2018-12698, CVE-2018-12699, CVE-2018-12700, CVE-2018-17794, CVE-2018-17985, CVE-2018-18484, CVE-2018-18700, CVE-2018-18701, CVE-2018-10372, CVE-2018-10373, CVE-2018-10534, CVE-2018-10535, CVE-2018-12934, CVE-2018-18483, CVE-2018-17358, CVE-2018-17359, CVE-2018-17360, CVE-2018-18309, CVE-2018-18605, CVE-2018-18606, CVE-2018-18607, CVE-2018-19931, CVE-2018-19932, CVE-2018-20002, CVE-2018-20623, CVE-2018-20671, CVE-2018-1000876, CVE-2017-17125, CVE-2019-9073, CVE-2019-9074, CVE-2019-9075, CVE-2019-9077, CVE-2019-9070, CVE-2019-9071, CVE-2019-12972, CVE-2019-14250, CVE-2019-14444, CVE-2019-17450, CVE-2019-17451

This update provides the binutils 2.33.1 and fixes at least the following security issues:

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap- based buffer overflow (CVE-2019-14250).

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file )CVE-2019-17450).

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm (CVE-2019-17451).

GNU binutils gold linker is affected by Improper Input Validation, Signed/ Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The attack vector is: An ELF file with an invalid e_shoff header field must be opened (CVE-2019-1010204).

For more information about the other changes and additional features of binutils / gas / ld in this update, see the referenced sourceware.org NEWS links.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update includes the GNU Compiler Collection 9.

This update ships the GCC 9.3 release.

A full changelog is provided by the GCC team on:

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)
• Includes a fix for Internal compiler error when building HepMC (bsc#1167898)
• Includes fix for binutils version parsing
• Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10.
• Add gcc9 autodetect -g at lto link (bsc#1149995)
• Install go tool buildid for bootstrapping go

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cpp7-7.5.0+r278197-10.1 package on the GA media of openSUSE Tumbleweed.

This update for gcc7 to r275405 fixes the following issues:

Security issues fixed:

• CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
• CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).

Non-security issue fixed:

• Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).

This update includes the GNU Compiler Collection 9.

A full changelog is provided by the GCC team on:

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)

This update for gcc9 fixes the following issues:

The GNU Compiler Collection is shipped in version 9.

A detailed changelog on what changed in GCC 9 is available at https://gcc.gnu.org/gcc-9/changes.html

The compilers have been added to the SUSE Linux Enterprise Toolchain Module.

To use these compilers, install e.g. gcc9, gcc9-c++ and build with CC=gcc-9 CXX=g++-9 set.

For SUSE Linux Enterprise base products, the libstdc++6, libgcc_s1 and other compiler libraries have been switched from their gcc8 variants to their gcc9 variants.

Security issues fixed:

• CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
• CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed:

• Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
• Fixed miscompilation for vector shift on s390. (bsc#1141897)

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

This update for binutils fixes the following issues:

binutils was updated to version 2.35.1 (jsc#ECO-2373)

Additional branch fixes applied on top of 2.35.1:

• Fixes PR26520, aka [bsc#1179036], a problem in addr2line with certain DWARF variable descriptions.
• Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878, PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869, PR26711
• The above includes fixes for dwo files produced by modern dwp, fixing several problems in the DWARF reader.

Update to binutils 2.35.1 and rebased branch diff:

• This is a point release over the previous 2.35 version, containing bug fixes, and as an exception to the usual rule, one new feature. The new feature is the support for a new directive in the assembler: '.nop'. This directive creates a single no-op instruction in whatever encoding is correct for the target architecture. Unlike the .space or .fill this is a real instruction, and it does affect the generation of DWARF line number tables, should they be enabled.

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add…

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for the arm-symbianelf format has been removed.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

General:

• When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
• Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
• Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

X86/x86_64:

 * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
  …

This update for gcc48 fixes the following issues:

• CVE-2019-14250: Fixed an integer overflow that could lead to an invalid memory access (bsc#1142649).

Non-security fixes:

• Fixed an issue with manual page builds (bsc#1185395).
• Fixed an issue with static initializers (bsc#1177947).
• Fixed an issue with exception handling on s390x (bsc#1161913).

This update for gcc7 fixes the following issues:

Security issues fixed:

• CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).
• CVE-2019-15847: Fixed POWER9 DARN miscompilation. (bsc#1149145)
• CVE-2019-14250: Includes fix for LTO linker plugin heap overflow. (bsc#1142649)

Update to GCC 7.5.0 release.

Other changes:

• Fixed KASAN kernel compile. (bsc#1205145)
• Fixed ICE with C++17 code. (bsc#1204505)
• Fixed altivec.h redefining bool in C++ which makes bool unusable (bsc#1195517):
• Adjust gnats idea of the target, fixing the build of gprbuild. [bsc#1196861]
• Do not handle exceptions in std::thread (jsc#CAR-1182)
• add -fpatchable-function-entry feature to gcc-7.
• Fixed glibc namespace violation with getauxval. (bsc#1167939)
• Backport aarch64 Straight Line Speculation mitigation [bsc#1172798, CVE-2020-13844]
• Enable fortran for the nvptx offload compiler.
• Update README.First-for.SuSE.packagers
• Avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel.
• Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its default enabling. (jsc#SLE-12209, bsc#1167939)
• Fixed memcpy miscompilation on aarch64. (bsc#1178624, bsc#1178577)
• Fixed debug line info for try/catch. (bsc#1178614)
• Fixed corruption of pass private ->aux via DF. (gcc#94148)
• Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888]
• Fixed register allocation issue with exception handling code on s390x. (bsc#1161913)
• Backport PR target/92692 to fix miscompilation of some atomic code on aarch64. (bsc#1150164)
• Fixed miscompilation in vectorized code for s390x. (bsc#1160086) [gcc#92950]
• Fixed miscompilation with thread-safe local static initialization. [gcc#85887]
• Fixed debug info created for array definitions that complete an earlier declaration. [bsc#1146475]
• Fixed vector shift miscompilation on s390. (bsc#1141897)
• Add gcc7 -flive-patching patch. [bsc#1071995, fate#323487]
• Strip -flto from $optflags.
• Disables switch jump-tables when retpolines are used. (bsc#1131264, jsc#SLE-6738)
• Fixed ICE compiling tensorflow on aarch64. (bsc#1129389)
• Fixed for aarch64 FMA steering pass use-after-free. (bsc#1128794)
• Fixed ICE compiling tensorflow. (bsc#1129389)
• Fixed s390x FP load-and-test issue. (bsc#1124644)
• Adjust gnat manual entries in the info directory. (bsc#1114592)
• Fixed to no longer try linking -lieee with -mieee-fp. (bsc#1084842)

It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service, or possibly execute arbitrary code

It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.