Skip to content
OpenAdvisories
Medium ALAS2-2024-2401 8 CVEs

Moderate: binutils security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1972: Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c. CVE-2022-48064: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. CVE-2022-47010: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47008: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47007: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-35205: An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. CVE-2021-46174: Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. CVE-2020-19724: A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 binutils 0:2.29.1-31.amzn2.0.1
Amazon Linux · 2 binutils-debuginfo 0:2.29.1-31.amzn2.0.1
Amazon Linux · 2 binutils-devel 0:2.29.1-31.amzn2.0.1

Vulnerabilities 8

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19724.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-46174.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-35205.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-47007.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-47008.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-47010.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48064.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1972.html