The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1635 advisory.

    The GNU Debugger (GDB) allows users to debug programs written in various programming languages including     C, C++, and Fortran.

    Security Fix(es):

    * gdb: buffer overflow while opening an ELF for debugging leads to Dos, information dislosure and code     execution (CVE-2019-1010180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gdb package has been released.

This update for gdb fixes the following issues :

Update to gdb 8.3.1: (jsc#ECO-368)

Security issues fixed :

  - CVE-2019-1010180: Fixed a potential buffer overflow when     loading ELF sections larger than the file. (bsc#1142772)

Upgrade libipt from v2.0 to v2.0.1.

  - Enable librpm for version > librpm.so.3 [bsc#1145692] :

  - Allow any librpm.so.x

  - Add %build test to check for 'zypper install     <rpm-packagename>' message

  - Copy gdbinit from fedora master @ 25caf28. Add     gdbinit.without-python, and use it for --without=python.

Rebase to 8.3 release (as in fedora 30 @ 1e222a3).

  - DWARF index cache: GDB can now automatically save     indices of DWARF symbols on disk to speed up further     loading of the same binaries.

  - Ada task switching is now supported on aarch64-elf     targets when debugging a program using the Ravenscar     Profile.

  - Terminal styling is now available for the CLI and the     TUI.

  - Removed support for old demangling styles arm, edg, gnu,     hp and lucid.

  - Support for new native configuration RISC-V GNU/Linux     (riscv*-*-linux*).

  - Implemented access to more POWER8 registers.
    [fate#326120, fate#325178]

  - Handle most of new s390 arch13 instructions.
    [fate#327369, jsc#ECO-368]

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1635 advisory.

    [8.2-11.0.1]
    - Import Implement s390x arch13 support (Andreas Krebbel, RH BZ 1768593).

    [8.2-8.0.2]
    - Forward-port patches from ol8-u1:
      gdb-ctf-forward-type.patch       gdb-ctf-func-args.patch       gdb-ctf-optout-var.patch
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [8.2-8.0.1]
    - Forward-port patches from ol8-u1:
      gdb-ctf.patch       gdb-ctf-upstream1.patch       gdb-ctf-prfunc.patch
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [8.2-8.el8]
    - Fix buffer overflow reading sections with invalid sizes       (Keith Seitz, RH BZ 1742099)

    [8.2-7.el8]
    - Fix segfault that happens on parse_macro_definition because       debugedit corrupts the .debug_macro section (Sergio Durigan Junior,       RH BZ 1708192).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gdb fixes the following issues :

Update to gdb 8.3.1: (jsc#ECO-368)

Security issues fixed :

CVE-2019-1010180: Fixed a potential buffer overflow when loading ELF sections larger than the file. (bsc#1142772)

Upgrade libipt from v2.0 to v2.0.1. Enable librpm for version > librpm.so.3 [bsc#1145692] :

  - Allow any librpm.so.x

  - Add %build test to check for 'zypper install     <rpm-packagename>' message </rpm-packagename>

Copy gdbinit from fedora master @ 25caf28. Add gdbinit.without-python, and use it for --without=python.

Rebase to 8.3 release (as in fedora 30 @ 1e222a3). DWARF index cache:
GDB can now automatically save indices of DWARF symbols on disk to speed up further loading of the same binaries.

Ada task switching is now supported on aarch64-elf targets when debugging a program using the Ravenscar Profile.

Terminal styling is now available for the CLI and the TUI.

Removed support for old demangling styles arm, edg, gnu, hp and lucid.

Support for new native configuration RISC-V GNU/Linux (riscv*-*-linux*).

Implemented access to more POWER8 registers. [fate#326120, fate#325178]

Handle most of new s390 arch13 instructions. [fate#327369, jsc#ECO-368]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for binutils fixes the following issues :

binutils was updated to current 2.32 branch [jsc#ECO-368].

Includes following security fixes :

CVE-2018-17358: Fixed invalid memory access in
_bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)

CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)

CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)

CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)

CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)

CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)

CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)

CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)

CVE-2018-18606: Fixed a NULL pointer dereference in
_bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)

CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)

CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)

CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)

CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)

CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)

CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in load_specific_debug_section in objdump.c (bsc#1121056)

CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)

CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)

enable xtensa architecture (Tensilica lc6 and related)

Use -ffat-lto-objects in order to provide assembly for static libs (bsc#1141913).

Fixed some LTO build issues (bsc#1133131 bsc#1133232).

riscv: Don't check ABI flags if no code section

Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).

Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).

Update to binutils 2.32: The binutils now support for the C-SKY processor series.

The x86 assembler now supports a -mvexwig=[0|1] option to control encoding of VEX.W-ignored (WIG) VEX instructions. It also has a new

-mx86-used-note=[yes|no] option to generate (or not) x86 GNU property notes.

The MIPS assembler now supports the Loongson EXTensions R2 (EXT2), the Loongson EXTensions (EXT) instructions, the Loongson Content Address Memory (CAM) ASE and the Loongson MultiMedia extensions Instructions (MMI) ASE.

The addr2line, c++filt, nm and objdump tools now have a default limit on the maximum amount of recursion that is allowed whilst demangling strings. This limit can be disabled if necessary.

Objdump's --disassemble option can now take a parameter, specifying the starting symbol for disassembly. Disassembly will continue from this symbol up to the next symbol or the end of the function.

The BFD linker will now report property change in linker map file when merging GNU properties.

The BFD linker's -t option now doesn't report members within archives, unless -t is given twice. This makes it more useful when generating a list of files that should be packaged for a linker bug report.

The GOLD linker has improved warning messages for relocations that refer to discarded sections.

Improve relro support on s390 [fate#326356]

Fix broken debug symbols (bsc#1118644)

Handle ELF compressed header alignment correctly.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136058	RHEL 8 : gdb (RHSA-2020:1635)	Nessus	Red Hat Local Security Checks	2020/4/28	2024/11/7	high
135303	Photon OS 2.0: Gdb PHSA-2020-2.0-0225	Nessus	PhotonOS Local Security Checks	2020/4/10	2024/7/23	high
203078	Photon OS 3.0: Gdb PHSA-2019-3.0-0036	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	high
130940	openSUSE Security Update : gdb (openSUSE-2019-2494)	Nessus	SuSE Local Security Checks	2019/11/13	2024/4/11	high
180981	Oracle Linux 8 : gdb (ELSA-2020-1635)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
130752	SUSE SLED15 / SLES15 Security Update : gdb (SUSE-SU-2019:2913-1)	Nessus	SuSE Local Security Checks	2019/11/8	2024/4/12	high
130340	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2019:2780-1)	Nessus	SuSE Local Security Checks	2019/10/28	2021/1/13	high

检测

插件搜索

high

high

high

high

high

high

high