CVE-2019-9077

An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.

• SECURITY UPDATE:
  • CVE-*.patch: backported many upstream patches to fix security issues.
  • CVE-2016-2226, CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131, CVE-2016-4491, CVE-2017-6965, CVE-2017-6966, CVE-2017-6969, CVE-2017-7209, CVE-2017-7210, CVE-2017-7223, CVE-2017-7224, CVE-2017-7225, CVE-2017-7226, CVE-2017-7227, CVE-2017-7299, CVE-2017-7300, CVE-2017-7301, CVE-2017-7302, CVE-2017-7614, CVE-2017-8393, CVE-2017-8394, CVE-2017-8395, CVE-2017-8397, CVE-2017-8396, CVE-2017-8398, CVE-2017-8421, CVE-2017-9038, CVE-2017-9039, CVE-2017-9040, CVE-2017-9042, CVE-2017-9041, CVE-2017-9044, CVE-2017-9742, CVE-2017-9744, CVE-2017-9752, CVE-2017-9745, CVE-2017-9746, CVE-2017-9747, CVE-2017-9748, CVE-2017-9749, CVE-2017-9750, CVE-2017-9751, CVE-2017-9753, CVE-2017-9754, CVE-2017-9755, CVE-2017-9756, CVE-2017-9954, CVE-2017-12448, CVE-2017-12449, CVE-2017-12455, CVE-2017-12457, CVE-2017-12458, CVE-2017-12459, CVE-2017-12450, CVE-2017-12452, CVE-2017-12453, CVE-2017-12454, CVE-2017-12456, CVE-2017-14333, CVE-2017-12451, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710, CVE-2017-14128, CVE-2017-14129, CVE-2017-14130, CVE-2017-14529, CVE-2017-14930, CVE-2017-14932, CVE-2017-14938, CVE-2017-14939, CVE-2017-14940, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022, CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938, CVE-2017-15939, CVE-2017-15996, CVE-2017-16826, CVE-2017-16827, CVE-2017-16828, CVE-2017-16831, CVE-2017-16832, CVE-2017-17080, CVE-2017-17121, CVE-2017-17123, CVE-2017-17124, CVE-2018-6323, CVE-2018-6543, CVE-2018-6759, CVE-2018-7208, CVE-2018-7568, CVE-2018-7569, CVE-2018-7642, CVE-2018-7643, CVE-2018-8945, CVE-2018-13033, CVE-2018-9138, CVE-2018-12641, CVE-2018-12697, CVE-2018-12698, CVE-2018-12699, CVE-2018-12700, CVE-2018-17794, CVE-2018-17985, CVE-2018-18484, CVE-2018-18700, CVE-2018-18701, CVE-2018-10372, CVE-2018-10373, CVE-2018-10534, CVE-2018-10535, CVE-2018-12934, CVE-2018-18483, CVE-2018-17358, CVE-2018-17359, CVE-2018-17360, CVE-2018-18309, CVE-2018-18605, CVE-2018-18606, CVE-2018-18607, CVE-2018-19931, CVE-2018-19932, CVE-2018-20002, CVE-2018-20623, CVE-2018-20671, CVE-2018-1000876, CVE-2017-17125, CVE-2019-9073, CVE-2019-9074, CVE-2019-9075, CVE-2019-9077, CVE-2019-9070, CVE-2019-9071, CVE-2019-12972, CVE-2019-14250, CVE-2019-14444, CVE-2019-17450, CVE-2019-17451

• CVE-2018-6323: Fix unsigned integer overflow
• CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in
• CVE-2018-6543: Fix integer overflow
• CVE-2018-20671: Fix integer overflow vulnerability
• CVE-2018-6759: Fix segmentation fault
• CVE-2018-7208: Fix segmentation fault
• CVE-2018-7568: Fix integer overflow
• CVE-2018-7569: Fix integer underflow or overflow
• CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference
• CVE-2018-7643: Fix integer overflow
• CVE-2018-8945: Fix segmentation fault
• CVE-2018-13033: Fix excessive memory allocation
• CVE-2018-10373: Fix NULL pointer dereference
• CVE-2018-10535: Fix NULL pointer dereference
• CVE-2018-18309: Fix invalid memory address dereference
• CVE-2018-18605: Fix mishandles section merges
• CVE-2018-18606: Fix NULL pointer dereference
• CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd
• CVE-2018-19932: Fix integer overflow and infinite loop
• CVE-2018-20002: Fix memory consumption
• CVE-2018-20623: Fix use-after-free in the error function
• CVE-2018-1000876: Fix integer overflow trigger heap overflow
• CVE-2019-9073: Fix excessive memory allocation
• CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap
• CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific
• CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt
• CVE-2019-14444: Fix integer overflow
• CVE-2019-17450: Fix infinite recursion
• CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c
• CVE-2016-4487: Fix use-after-free vulnerability in libiberty
• CVE-2016-4488: Fix use-after-free vulnerability in libiberty
• CVE-2016-4489: Fix integer overflow in libiberty
• CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty
• CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty
• CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal
• CVE-2016-6131: Fix infinite loop, stack overflow

• CVE-2018-6323: Fix unsigned integer overflow
• CVE-2018-19931: Fix heap-based buffer overflow in bfd_elf32_swap_phdr_in
• CVE-2018-6543: Fix integer overflow
• CVE-2018-20671: Fix integer overflow vulnerability
• CVE-2018-6759: Fix segmentation fault
• CVE-2018-7208: Fix segmentation fault
• CVE-2018-7568: Fix integer overflow
• CVE-2018-7569: Fix integer underflow or overflow
• CVE-2018-7642: Fix aout_32_swap_std_reloc_out NULL pointer dereference
• CVE-2018-7643: Fix integer overflow
• CVE-2018-8945: Fix segmentation fault
• CVE-2018-13033: Fix excessive memory allocation
• CVE-2018-10373: Fix NULL pointer dereference
• CVE-2018-10535: Fix NULL pointer dereference
• CVE-2018-18309: Fix invalid memory address dereference
• CVE-2018-18605: Fix mishandles section merges
• CVE-2018-18606: Fix NULL pointer dereference
• CVE-2018-18607: Fix NULL pointer dereference in elf_link_input_bfd
• CVE-2018-19932: Fix integer overflow and infinite loop
• CVE-2018-20002: Fix memory consumption
• CVE-2018-20623: Fix use-after-free in the error function
• CVE-2018-1000876: Fix integer overflow trigger heap overflow
• CVE-2019-9073: Fix excessive memory allocation
• CVE-2019-9075: Fix heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap
• CVE-2019-9077: Fix heap-based buffer overflow in process_mips_specific
• CVE-2019-12972: Fix heap-based buffer over-read in _bfd_doprnt
• CVE-2019-14444: Fix integer overflow
• CVE-2019-17450: Fix infinite recursion
• CVE-2016-2226: Fix integer overflow in the string_appends function in cplus-dem.c
• CVE-2016-4487: Fix use-after-free vulnerability in libiberty
• CVE-2016-4488: Fix use-after-free vulnerability in libiberty
• CVE-2016-4489: Fix integer overflow in libiberty
• CVE-2016-4490: Fix integer overflow in cp-demangle.c in libiberty
• CVE-2016-4492: Fix buffer overflow in the do_type function in cplus-dem.c in libiberty
• CVE-2016-4493: Fix out-of-bounds read in demangle_template_value_parm and do_hpacc_template_literal
• CVE-2016-6131: Fix infinite loop, stack overflow

This update provides the latest stable binutils, currently version 2.32 and fixes at least the following security issues:

ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects (CVE-2014-9939)

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec." (CVE-2016-4487)

Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec." (CVE-2016-4488)

Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables." (CVE-2016-4489)

Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths. (CVE-2016-4490)

Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary. (CVE-2016-4492)

The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary. (CVE-2016-4493)

The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types. (CVE-2016-6131)

readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow. (CVE-2017-6965)

readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations. (CVE-2017-6966)

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well. (CVE-2017-6969)

The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash. (CVE-2017-7209)

objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash. (CVE-2017-7210)

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash. (CVE-2017-7223)

The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash. (CVE-2017-7224)

The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash. (CVE-2017-7225)

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well. (CVE-2017-7226)

GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while…

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
• Add --source-comment[=<txt>] option to objdump which if present, provides a prefix to source code lines displayed in a disassembly.
• Add --set-section-alignment <section-name>=<power-of-2-align> option to objcopy to allow the changing of section alignments.
• Add --verilog-data-width option to objcopy for verilog targets to control width of data elements in verilog hex format.
• The separate debug info file options of readelf (--debug-dump=links and --debug-dump=follow) and objdump (--dwarf=links and --dwarf=follow-links) will now display and/or follow multiple links if more than one are present in a file. (This usually happens when gcc's -gsplit-dwarf option is used). In addition objdump's --dwarf=follow-links now also affects its other display options, so that for example, when combined with --syms it will cause the symbol tables in any linked debug info …

This update for binutils fixes the following issues:

binutils was updated to version 2.35.1 (jsc#ECO-2373)

Additional branch fixes applied on top of 2.35.1:

• Fixes PR26520, aka [bsc#1179036], a problem in addr2line with certain DWARF variable descriptions.
• Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878, PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869, PR26711
• The above includes fixes for dwo files produced by modern dwp, fixing several problems in the DWARF reader.

Update to binutils 2.35.1 and rebased branch diff:

• This is a point release over the previous 2.35 version, containing bug fixes, and as an exception to the usual rule, one new feature. The new feature is the support for a new directive in the assembler: '.nop'. This directive creates a single no-op instruction in whatever encoding is correct for the target architecture. Unlike the .space or .fill this is a real instruction, and it does affect the generation of DWARF line number tables, should they be enabled.

Update to binutils 2.35:

• The assembler can now produce DWARF-5 format line number tables.
• Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
• Readelf will now display '[...]' when it has to truncate a symbol name.
  The old behaviour - of displaying as many characters as possible, up to the 80 column limit - can be restored by the use of the --silent-truncation option.
• The linker can now produce a dependency file listing the inputs that it has processed, much like the -M -MP option supported by the compiler.

• fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34:

• The disassembler (objdump --disassemble) now has an option to generate ascii art thats show the arcs between that start and end points of control flow instructions.
• The binutils tools now have support for debuginfod. Debuginfod is a HTTP service for distributing ELF/DWARF debugging information as well as source code. The tools can now connect to debuginfod servers in order to download debug information about the files that they are processing.
• The assembler and linker now support the generation of ELF format files for the Z80 architecture.

• Add new subpackages for libctf and libctf-nobfd.

• Disable LTO due to bsc#1163333.

• Includes fixes for these CVEs: bsc#1153768 aka CVE-2019-17451 aka PR25070 bsc#1153770 aka CVE-2019-17450 aka PR25078

• fix various build fails on aarch64 (PR25210, bsc#1157755).

Update to binutils 2.33.1:

• Adds support for the Arm Scalable Vector Extension version 2 (SVE2) instructions, the Arm Transactional Memory Extension (TME) instructions and the Armv8.1-M Mainline and M-profile Vector Extension (MVE) instructions.
• Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77 processors.
• Adds a .float16 directive for both Arm and AArch64 to allow encoding of 16-bit floating point literals.
• For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not) Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no] configure time option to set the default behavior. Set the default if the configure option is not used to 'no'.
• The Cortex-A53 Erratum 843419 workaround now supports a choice of which workaround to use. The option --fix-cortex-a53-843419 now takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp] which can be used to force a particular workaround to be used. See --help for AArch64 for more details.
• Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties in the AArch64 ELF linker.
• Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI on inputs and use PLTs protected with BTI.
• Add…

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for the arm-symbianelf format has been removed.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

General:

• When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
• Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
• Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

X86/x86_64:

 * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
  …

It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.