{"id":"MGASA-2020-0112","summary":"Updated binutils packages fix security vulnerabilities","details":"This update provides the binutils 2.33.1 and fixes at least the\nfollowing security issues:\n\nAn issue was discovered in GNU libiberty, as distributed in GNU Binutils\n2.32. simple_object_elf_match in simple-object-elf.c does not check for a\nzero shstrndx value, leading to an integer overflow and resultant heap-\nbased buffer overflow (CVE-2019-14250).\n\nfind_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD)\nlibrary (aka libbfd), as distributed in GNU Binutils 2.32, allows remote\nattackers to cause a denial of service (infinite recursion and application\ncrash) via a crafted ELF file )CVE-2019-17450).\n\nAn issue was discovered in the Binary File Descriptor (BFD) library (aka\nlibbfd), as distributed in GNU Binutils 2.32. It is an integer overflow\nleading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as\ndemonstrated by nm (CVE-2019-17451).\n\nGNU binutils gold linker is affected by Improper Input Validation, Signed/\nUnsigned Comparison, Out-of-bounds Read. The impact is: Denial of service.\nThe attack vector is: An ELF file with an invalid e_shoff header field\nmust be opened (CVE-2019-1010204).\n\nFor more information about the other changes and additional features of\nbinutils / gas / ld in this update, see the referenced sourceware.org\nNEWS links.\n","modified":"2026-02-04T04:23:23.770311Z","published":"2020-03-06T16:13:58Z","related":["CVE-2019-1010204","CVE-2019-14250","CVE-2019-17450","CVE-2019-17451"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2020-0112.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=25298"},{"type":"REPORT","url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob_plain;f=binutils/NEWS;hb=refs/tags/binutils-2_33_1"},{"type":"REPORT","url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob_plain;f=gas/NEWS;hb=refs/tags/binutils-2_33_1"},{"type":"REPORT","url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob_plain;f=ld/NEWS;hb=refs/tags/binutils-2_33_1"}],"affected":[{"package":{"name":"binutils","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/binutils?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-1.mga7"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2020-0112.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}