SB2019060405 - Arch Linux update for binutils

Description

This security bulletin contains information about 4 vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2018-19931)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the bfd_elf32_swap_phdr_in function, as defined in the elfcode.h source code file when handling malicious input. A local attacker can supply a specially crafted file that may trigger memory corruption and cause the service to crash.

2) Integer overflow (CVE-ID: CVE-2018-19932)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in the IS_CONTAINED_BY_LMAfunction, as defined in the elf.c source code file when handling malicious input. A local attacker can map a section to a segment, trigger an infinite loop condition, resulting in a DoS condition.

3) Memory leak (CVE-ID: CVE-2018-20002)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak in the _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils. A local attacker can send specially crafted ELF file, consume excessive resources and cause the service to crash.

4) Heap-based out-of-bounds read (CVE-ID: CVE-2018-20712)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a heap-based buffer over-read in the function d_expression_1 in cp-demangle.c in GNU libiberty. A remote attacker can pass specially crafted data to the application, trigger segmentation faults and read contents of memory on the system.

Remediation

Install update from vendor's website.

References

• https://security.archlinux.org/advisory/ASA-201906-3