SB2020042840 - Red Hat Enterprise Linux 8 update for binutils
Published: April 28, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2019-17451)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the _bfd_dwarf2_find_nearest_line() function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd). A remote attacker can #CONDITION2#, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Input validation error (CVE-ID: CVE-2019-1010204)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the improper processing of Executable Linkable Format (ELF) files with invalid "e_shoff" header fields in the "gold/fileread.cc:497" and "elfcpp/elfcpp_file.h:644" files. A remote attacker can trick a victim to open a specially crafted ELF file, cause an out-of-bounds read condition and perform a denial of service attack on the target system.
Remediation
Install update from vendor's website.