Summary
It was discovered that GNU binutils incorrectly handled certain DWARF
files. An attacker could possibly use this issue to cause a crash or
execute arbitrary code. This issue only affected Ubuntu 22.10.
(CVE-2023-1579)
It was discovered that GNU binutils did not properly verify the version
definitions in zer0-lengthverdef table. An attacker could possibly use this
issue to cause a crash or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-1972)
It was discovered that GNU binutils did not properly validate the size of
length parameter in vms-alpha. An attacker could possibly use this issue to
cause a crash or access sensitive information. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10.
(CVE-2023-25584)
It was discovered that GNU binutils did not properly initialized the
file_table field of struct module and the_bfd field of asymbol. An attacker
could possibly use this issue to cause a crash. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-25585, CVE-2023-25588)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | binutils | 2.30-21ubuntu1~18.04.9 |
| Ubuntu · 20.04 LTS 20.04:LTS | binutils | 2.34-6ubuntu1.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | binutils | 2.38-4ubuntu2.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | binutils | 2.24-5ubuntu14.2+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | binutils | 2.26.1-1ubuntu1~16.04.8+esm6 |
Vulnerabilities 4
-
Medium 6.5
A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss…
-
Medium 6.3
Out of bounds read in parse_module function in bfd/vms-alpha.c
An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.
-
Medium 4.7
Field `file_table` of `struct module *module` is uninitialized
A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.
-
Medium 4.7
Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`
A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.