CVE-2021-45078

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

Binary utilities.

Security Fix(es):

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.(CVE-2021-45078)

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

• CVE-2018-9138: Fix stack exhaustion
• CVE-2018-12641: Fix stack exhaustion
• CVE-2018-12697: Fix NULL pointer dereference
• CVE-2018-12698: Fix memory consumption
• CVE-2018-12699: Fix heap-based buffer overflow
• CVE-2018-12700: Fix infinite recursion
• CVE-2018-17794: Fix NULL pointer dereference
• CVE-2018-17985: Fix recursive calls
• CVE-2018-18484: Fix stack exhaustion
• CVE-2018-18700: Fix stack consumption vulnerability
• CVE-2018-18701: Fix infinite recursion
• CVE-2018-18483: Fix malloc call with the result of an integer-overflowing calculation
• CVE-2018-12934: Fix excessive memory consumption
• CVE-2021-45078: Fix heap-based buffer overflow

• SECURITY UPDATE:
  • debian/patches/CVE-2018-12700.patch: fix infinite recursion.
  • debian/patches/CVE-2021-45078.patch: fix heap-based buffer overflow.
  • CVE-2018-12700, CVE-2021-45078

• CVE-2018-9138: Fix stack exhaustion
• CVE-2018-12641: Fix stack exhaustion
• CVE-2018-12697: Fix NULL pointer dereference
• CVE-2018-12698: Fix memory consumption
• CVE-2018-12699: Fix heap-based buffer overflow
• CVE-2018-12700: Fix infinite recursion
• CVE-2018-17794: Fix NULL pointer dereference
• CVE-2018-17985: Fix recursive calls
• CVE-2018-18484: Fix stack exhaustion
• CVE-2018-18700: Fix stack consumption vulnerability
• CVE-2018-18701: Fix infinite recursion
• CVE-2018-18483: Fix malloc call with the result of an integer-overflowing
• CVE-2018-12934: Fix excessive memory consumption
• CVE-2021-45078: Fix heap-based buffer overflow

• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type() in stabs.c

• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type() in stabs.c

• SECURITY UPDATE: heap-buffer-overflow
  • debian/patches/CVE-2021-45078.patch: fix out-of-bounds write in stab_xcoff_builtin_type (bz: #28694)
  • CVE-2021-45078

• CVE-2017-16831: Fix excessive memory allocation attempts and possible integer overflows when attempting to read a COFF binary with a corrupt symbol count
• CVE-2020-19726: Fix parsing a corrupt PE format file
• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type
• CVE-2021-46174: Fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: Fix possible heap buffer overflow in find_section_in_set() in readelf.c
• CVE-2022-45703: Combine sanity checks, calculate element counts, not word counts, fix typo
• CVE-2022-47695: Test symbol flags to exclude section and synthetic symbols before attempting to check flavour
• CVE-2022-47696: Fix uninitialised field the_bfd of asymbol
• CVE-2022-47673: Fix lack of bounds checking in vms-alpha.c

• CVE-2021-45078: Fix out-of-bounds write in stab_xcoff_builtin_type
• CVE-2021-46174: Fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: Fix possible heap buffer overflow in find_section_in_set() in readelf.c
• CVE-2022-45703: Combine sanity checks, calculate element counts, not word counts, fix typo
• CVE-2022-47695: Test symbol flags to exclude section and synthetic symbols before attempting to check flavour
• CVE-2022-47696: Fix uninitialised field the_bfd of asymbol
• CVE-2022-47673: Fix lack of bounds checking in vms-alpha.c

• CVE-2021-45078: fix heap-based buffer overflow in stab_xcoff_builtin_type
• CVE-2021-46174: fix buffer overflow in read_section_stabs_debugging_info
• CVE-2022-44840: fix heap buffer overflow in find_section_in_set
• CVE-2022-45703: fix heap buffer overflow in display_gdb_index
• CVE-2022-47695: fix segmentation fault in compare_symbols
• CVE-2022-47696: fix DoS in bfd_mach_o_get_synthetic_symtab
• CVE-2022-47673: fix out-of-bounds reads in parse_module
• CVE-2025-11082: fix heap-based buffer overflow in _bfd_elf_parse_eh_frame

These are all security issues fixed in the binutils-2.39-2.1 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

The following security bugs were fixed:

• CVE-2019-1010204: Fixed out-of-bounds read in elfcpp/elfcpp_file.h (bsc#1142579).
• CVE-2021-3530: Fixed stack-based buffer overflow in demangle_path() in rust-demangle.c (bsc#1185597).
• CVE-2021-3648: Fixed infinite loop while demangling rust symbols (bsc#1188374).
• CVE-2021-3826: Fixed heap/stack buffer overflow in the dlang_lname function in d-demangle.c (bsc#1202969).
• CVE-2021-45078: Fixed out-of-bounds write in stab_xcoff_builtin_type() in stabs.c (bsc#1193929).
• CVE-2021-46195: Fixed uncontrolled recursion in libiberty/rust-demangle.c (bsc#1194783).
• CVE-2022-27943: Fixed stack exhaustion in demangle_const in (bsc#1197592).
• CVE-2022-38126: Fixed assertion fail in the display_debug_names() function in binutils/dwarf.c (bsc#1202966).
• CVE-2022-38127: Fixed NULL pointer dereference in the read_and_display_attr_value() function in binutils/dwarf.c (bsc#1202967).
• CVE-2022-38533: Fixed heap out-of-bounds read in bfd_getl32 (bsc#1202816).

The following non-security bugs were fixed:

• SLE toolchain update of binutils, update to 2.39 from 2.37.

• Update to 2.39:

  • The ELF linker will now generate a warning message if the stack is made executable. Similarly it will warn if the output binary contains a segment with all three of the read, write and execute permission bits set. These warnings are intended to help developers identify programs which might be vulnerable to attack via these executable memory regions. The warnings are enabled by default but can be disabled via a command line option. It is also possible to build a linker with the warnings disabled, should that be necessary.
  • The ELF linker now supports a --package-metadata option that allows embedding a JSON payload in accordance to the Package Metadata specification.
  • In linker scripts it is now possible to use TYPE=<type> in an output section description to set the section type value.
  • The objdump program now supports coloured/colored syntax highlighting of its disassembler output for some architectures. (Currently: AVR, RiscV, s390, x86, x86_64).
  • The nm program now supports a --no-weak/-W option to make it ignore weak symbols.
  • The readelf and objdump programs now support a -wE option to prevent them from attempting to access debuginfod servers when following links.
  • The objcopy program's --weaken, --weaken-symbol, and --weaken-symbols options now works with unique symbols as well.

• Update to 2.38:

  • elfedit: Add --output-abiversion option to update ABIVERSION.
  • Add support for the LoongArch instruction set.
  • Tools which display symbols or strings (readelf, strings, nm, objdump) have a new command line option which controls how unicode characters are handled. By default they are treated as normal for the tool. Using --unicode=locale will display them according to the current locale. Using --unicode=hex will display them as hex byte values, whilst --unicode=escape will display them as escape sequences. In addition using --unicode=highlight will display them as unicode escape sequences highlighted in red (if supported by the output device).
  • readelf -r dumps RELR relative relocations now.
  • Support for efi-app-aarch64, efi-rtdrv-aarch64 and efi-bsdrv-aarch64 has been added to objcopy in order to enable UEFI development using binutils.
  • ar: Add --thin for creating thin archives. -T is a deprecated alias without diagnostics. In many ar implementations -T has a different meaning, as specified by X/Open System Interface.
  • Add support for AArch64 system registers that were missing in previous releases.
  • Add support for the LoongArch instruction set.
  • Add a command-line option, -muse-unaligned-vector-move, for x86 target to encode aligned vector move as unaligned vector move.
  • Add support for…

This update for binutils fixes the following issues: The following security bugs were fixed:

• CVE-2019-1010204: Fixed out-of-bounds read in elfcpp/elfcpp_file.h (bsc#1142579).
• CVE-2021-3530: Fixed stack-based buffer overflow in demangle_path() in rust-demangle.c (bsc#1185597).
• CVE-2021-3648: Fixed infinite loop while demangling rust symbols (bsc#1188374).
• CVE-2021-3826: Fixed heap/stack buffer overflow in the dlang_lname function in d-demangle.c (bsc#1202969).
• CVE-2021-45078: Fixed out-of-bounds write in stab_xcoff_builtin_type() in stabs.c (bsc#1193929).
• CVE-2021-46195: Fixed uncontrolled recursion in libiberty/rust-demangle.c (bsc#1194783).
• CVE-2022-27943: Fixed stack exhaustion in demangle_const in (bsc#1197592).
• CVE-2022-38126: Fixed assertion fail in the display_debug_names() function in binutils/dwarf.c (bsc#1202966).
• CVE-2022-38127: Fixed NULL pointer dereference in the read_and_display_attr_value() function in binutils/dwarf.c (bsc#1202967).
• CVE-2022-38533: Fixed heap out-of-bounds read in bfd_getl32 (bsc#1202816).

The following non-security bugs were fixed:

• SLE toolchain update of binutils, update to 2.39 from 2.37.

• Update to 2.39:

  • The ELF linker will now generate a warning message if the stack is made executable. Similarly it will warn if the output binary contains a segment with all three of the read, write and execute permission bits set. These warnings are intended to help developers identify programs which might be vulnerable to attack via these executable memory regions. The warnings are enabled by default but can be disabled via a command line option. It is also possible to build a linker with the warnings disabled, should that be necessary.
  • The ELF linker now supports a --package-metadata option that allows embedding a JSON payload in accordance to the Package Metadata specification.
  • In linker scripts it is now possible to use TYPE=<type> in an output section description to set the section type value.
  • The objdump program now supports coloured/colored syntax highlighting of its disassembler output for some architectures. (Currently: AVR, RiscV, s390, x86, x86_64).
  • The nm program now supports a --no-weak/-W option to make it ignore weak symbols.
  • The readelf and objdump programs now support a -wE option to prevent them from attempting to access debuginfod servers when following links.
  • The objcopy program's --weaken, --weaken-symbol, and --weaken-symbols options now works with unique symbols as well.

• Update to 2.38:

  • elfedit: Add --output-abiversion option to update ABIVERSION.
  • Add support for the LoongArch instruction set.
  • Tools which display symbols or strings (readelf, strings, nm, objdump) have a new command line option which controls how unicode characters are handled. By default they are treated as normal for the tool. Using --unicode=locale will display them according to the current locale. Using --unicode=hex will display them as hex byte values, whilst --unicode=escape will display them as escape sequences. In addition using --unicode=highlight will display them as unicode escape sequences highlighted in red (if supported by the output device).
  • readelf -r dumps RELR relative relocations now.
  • Support for efi-app-aarch64, efi-rtdrv-aarch64 and efi-bsdrv-aarch64 has been added to objcopy in order to enable UEFI development using binutils (bsc#1198458).
  • ar: Add --thin for creating thin archives. -T is a deprecated alias without diagnostics. In many ar implementations -T has a different meaning, as specified by X/Open System Interface.
  • Add support for AArch64 system registers that were missing in previous releases.
  • Add support for the LoongArch instruction set.
  • Add a command-line option, -muse-unaligned-vector-move, for x86 target to encode aligned vector move as unaligned vector move.
  • Add…

It was discovered that GNU binutils incorrectly handled checks for memory allocation when parsing relocs in a corrupt file. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17122)

It was discovered that GNU binutils incorrectly handled certain corrupt DWARF debug sections. An attacker could possibly use this issue to cause GNU binutils to consume memory, resulting in a denial of service. (CVE-2021-3487)

It was discovered that GNU binutils incorrectly performed bounds checking operations when parsing stabs debugging information. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-45078)

It was discovered that GNU binutils incorrectly performed bounds checking operations when parsing stabs debugging information. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.