An update of the binutils package has been released.

An update of the crash package has been released.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gcc7 to r275405 fixes the following issues :

Security issues fixed :

  - CVE-2019-14250: Fixed an integer overflow in binutils     (bsc#1142649).

  - CVE-2019-15847: Fixed an optimization in the POWER9     backend of gcc that could reduce the entropy of the     random number generator (bsc#1149145).

Non-security issue fixed :

  - Move Live Patching technology stack from kGraft to     upstream klp (bsc#1071995, fate#323487).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gcc9 fixes the following issues :

The GNU Compiler Collection is shipped in version 9.

A detailed changelog on what changed in GCC 9 is available at https://gcc.gnu.org/gcc-9/changes.html

The compilers have been added to the SUSE Linux Enterprise Toolchain Module.

To use these compilers, install e.g. gcc9, gcc9-c++ and build with CC=gcc-9 CXX=g++-9 set.

For SUSE Linux Enterprise base products, the libstdc++6, libgcc_s1 and other compiler libraries have been switched from their gcc8 variants to their gcc9 variants.

Security issues fixed :

CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)

CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)

Non-security issues fixed: Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime.
(bsc#1135254)

Fixed miscompilation for vector shift on s390. (bsc#1141897)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0120 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-1010204:
    GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation,     Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is:
    gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff     header field must be opened.

    CVE-2019-14250:
    An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in     simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant     heap-based buffer overflow.

    CVE-2019-14444:
    apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to     trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as     demonstrated by readelf.

    CVE-2019-17450:
    find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file.

    CVE-2019-17451:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c,     as demonstrated by nm.

    CVE-2019-9071:
    An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption     issue in d_count_templates_scopes in cp-demangle.c after many recursive calls.

    CVE-2019-9073:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory allocation in _bfd_elf_slurp_version_tables in elf.c.

    CVE-2019-9074:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in pei-x86_64.c.

    CVE-2019-9075:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.

    CVE-2019-9077:
    An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific     in readelf.c via a malformed MIPS option section.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128729	Photon OS 3.0: Binutils PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	2019/9/12	2024/7/23	medium
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	2024/7/23	2025/8/20	critical
135150	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2020-1363)	Nessus	Huawei Local Security Checks	2020/4/2	2024/3/20	high
130159	openSUSE Security Update : gcc7 (openSUSE-2019-2364)	Nessus	SuSE Local Security Checks	2019/10/23	2024/4/17	high
133791	SUSE SLES12 Security Update : gcc9 (SUSE-SU-2020:0394-1)	Nessus	SuSE Local Security Checks	2020/2/19	2024/3/27	high
238840	TencentOS Server 3: binutils (TSSA-2022:0120)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high

检测

插件搜索

medium

critical

high

high

high

high