SB2023080950 - Ubuntu update for binutils
Published: August 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2017-9742)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
2) Input validation error (CVE-ID: CVE-2017-9747)
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
3) Input validation error (CVE-ID: CVE-2017-9748)
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
4) Buffer overflow (CVE-ID: CVE-2017-9750)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
5) Buffer overflow (CVE-ID: CVE-2017-9756)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.
6) Integer overflow (CVE-ID: CVE-2018-6323)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the elf_object_p function of the elfcode.h source code in the GNU Binutils binary file descriptor library due to integer overflow condition. A remote attacker can submit a specially crafted ELF file, trigger memory corruption and cause the service to crash.
Remediation
Install update from vendor's website.