An update of the crash package has been released.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:4465 advisory.

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3593-1 advisory.

    Update to binutils 2.37:

    * The GNU Binutils sources now requires a C99 compiler and library to       build.
    * Support for the arm-symbianelf format has been removed.
    * Support for Realm Management Extension (RME) for AArch64 has been       added.
    * A new linker option '-z report-relative-reloc' for x86 ELF targets       has been added to report dynamic relative relocations.
    * A new linker option '-z start-stop-gc' has been added to disable       special treatment of __start_*/__stop_* references when
      --gc-sections.
    * A new linker options '-Bno-symbolic' has been added which will       cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
    * The readelf tool has a new command line option which can be used to       specify how the numeric values of symbols are reported.
      --sym-base=0|8|10|16 tells readelf to display the values in base 8,       base 10 or base 16.  A sym base of 0 represents the default action       of displaying values under 10000 in base 10 and values above that in       base 16.
    * A new format has been added to the nm program.  Specifying       '--format=just-symbols' (or just using -j) will tell the program to       only display symbol names and nothing else.
    * A new command line option '--keep-section-symbols' has been added to       objcopy and strip.  This stops the removal of unused section symbols       when the file is copied.  Removing these symbols saves space, but       sometimes they are needed by other tools.
    * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options       supported by objcopy now make undefined symbols weak on targets that       support weak symbols.
    * Readelf and objdump can now display and use the contents of .debug_sup       sections.
    * Readelf and objdump will now follow links to separate debug info       files by default.  This behaviour can be stopped via the use of the       new '-wN' or '--debug-dump=no-follow-links' options for readelf and       the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also       the old behaviour can be restored by the use of the       '--enable-follow-debug-links=no' configure time option.

      The semantics of the =follow-links option have also been slightly       changed.  When enabled, the option allows for the loading of symbol       tables and string tables from the separate files which can be used       to enhance the information displayed when dumping other sections,       but it does not automatically imply that information from the       separate files should be displayed.

      If other debug section display options are also enabled (eg       '--debug-dump=info') then the contents of matching sections in both       the main file and the separate debuginfo file *will* be displayed.
      This is because in most cases the debug section will only be present       in one of the files.

      If however non-debug section display options are enabled (eg       '--sections') then the contents of matching parts of the separate       debuginfo file will *not* be displayed.  This is because in most       cases the user probably only wanted to load the symbol information       from the separate debuginfo file.  In order to change this behaviour       a new command line option --process-links can be used.  This will       allow di0pslay options to applied to both the main file and any       separate debuginfo files.
    * Nm has a new command line option: '--quiet'.  This suppresses 'no       symbols' diagnostic.

    Update to binutils 2.36:

     New features in the Assembler:

      General:

       * When setting the link order attribute of ELF sections, it is now          possible to use a numeric section index instead of symbol name.
       * Added a .nop directive to generate a single no-op instruction in          a target neutral manner.  This instruction does have an effect on          DWARF line number generation, if that is active.
       * Removed --reduce-memory-overheads and --hash-size as gas now          uses hash tables that can be expand and shrink automatically.

       X86/x86_64:

         * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key            Locker instructions.
         * Support non-absolute segment values for lcall and ljmp.
         * Add {disp16} pseudo prefix to x86 assembler.
         * Configure with --enable-x86-used-note by default for Linux/x86.

       ARM/AArch64:

         * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,            Cortex-R82, Neoverse V1, and Neoverse N2 cores.
         * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded            Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call            Stack Recorder Extension) and BRBE (Branch Record Buffer            Extension) system registers.
         * Add support for Armv8-R and Armv8.7-A ISA extensions.
         * Add support for DSB memory nXS barrier, WFET and WFIT            instruction for Armv8.7.
         * Add support for +csre feature for -march. Add CSR PDEC            instruction for CSRE feature in AArch64.
         * Add support for +flagm feature for -march in Armv8.4 AArch64.
         * Add support for +ls64 feature for -march in Armv8.7            AArch64. Add atomic 64-byte load/store instructions for this            feature.
         * Add support for +pauth (Pointer Authentication) feature for
           -march in AArch64.

      New features in the Linker:

        * Add --error-handling-script=<NAME> command line option to allow           a helper script to be invoked when an undefined symbol or a           missing library is encountered.  This option can be suppressed           via the configure time switch: --enable-error-handling-script=no.
        * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark           x86-64-{baseline|v[234]} ISA level as needed.
        * Add -z unique-symbol to avoid duplicated local symbol names.
        * The creation of PE format DLLs now defaults to using a more           secure set of DLL characteristics.
        * The linker now deduplicates the types in .ctf sections.  The new            command-line option --ctf-share-types describes how to do this:
           its default value, share-unconflicted, produces the most compact            output.
        * The linker now omits the 'variable section' from .ctf sections           by default, saving space.  This is almost certainly what you           want unless you are working on a project that has its own           analogue of symbol tables that are not reflected in the ELF           symtabs.

    New features in other binary tools:

        * The ar tool's previously unused l modifier is now used for           specifying dependencies of a static library. The arguments of           this option (or --record-libdeps long form option) will be           stored verbatim in the __.LIBDEP member of the archive, which           the linker may read at link time.
        * Readelf can now display the contents of LTO symbol table           sections when asked to do so via the --lto-syms command line           option.
        * Readelf now accepts the -C command line option to enable the           demangling of symbol names.  In addition the --demangle=<style>,
          --no-demangle, --recurse-limit and --no-recurse-limit options           are also now availale.

    Update to binutils 2.35.1:

    * This is a point release over the previous 2.35 version, containing bug       fixes, and as an exception to the usual rule, one new feature.  The       new feature is the support for a new directive in the assembler:
      '.nop'.  This directive creates a single no-op instruction in whatever       encoding is correct for the target architecture.  Unlike the .space or       .fill this is a real instruction, and it does affect the generation of       DWARF line number tables, should they be enabled.

    Update to binutils 2.35:

    * The assembler can now produce DWARF-5 format line number tables.
    * Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
    * Readelf will now display '[...]' when it has to truncate a symbol name.
      The old behaviour - of displaying as many characters as possible, up to       the 80 column limit - can be restored by the use of the --silent-truncation       option.
    * The linker can now produce a dependency file listing the inputs that it       has processed, much like the -M -MP option supported by the compiler.

    Update to binutils 2.34:

    * The disassembler (objdump --disassemble) now has an option to       generate ascii art thats show the arcs between that start and end       points of control flow instructions.
    * The binutils tools now have support for debuginfod.  Debuginfod is a       HTTP service for distributing ELF/DWARF debugging information as       well as source code.  The tools can now connect to debuginfod       servers in order to download debug information about the files that       they are processing.
    * The assembler and linker now support the generation of ELF format       files for the Z80 architecture.

    Update to binutils 2.33.1:

    * Adds support for the Arm Scalable Vector Extension version 2       (SVE2) instructions, the Arm Transactional Memory Extension (TME)       instructions and the Armv8.1-M Mainline and M-profile Vector       Extension (MVE) instructions.
    * Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P       processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE,       Cortex-A76AE, and Cortex-A77 processors.
    * Adds a .float16 directive for both Arm and AArch64 to allow       encoding of 16-bit floating point literals.
    * For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not)       Loongson3 LLSC Errata.  Add a --enable-mips-fix-loongson3-llsc=[yes|no]       configure time option to set the default behavior. Set the default       if the configure option is not used to 'no'.
    * The Cortex-A53 Erratum 843419 workaround now supports a choice of       which workaround to use.  The option --fix-cortex-a53-843419 now       takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp]       which can be used to force a particular workaround to be used.
      See --help for AArch64 for more details.
    * Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and       GNU_PROPERTY_AARCH64_FEATURE_1_PAC  in ELF GNU program properties       in the AArch64 ELF linker.
    * Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI       on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI       on inputs and use PLTs protected with BTI.
    * Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
    * Add --source-comment[=<txt>] option to objdump which if present,       provides a prefix to source code lines displayed in a disassembly.
    * Add --set-section-alignment <section-name>=<power-of-2-align>       option to objcopy to allow the changing of section alignments.
    * Add --verilog-data-width option to objcopy for verilog targets to       control width of data elements in verilog hex format.
    * The separate debug info file options of readelf (--debug-dump=links       and --debug-dump=follow) and objdump (--dwarf=links and
      --dwarf=follow-links) will now display and/or follow multiple       links if more than one are present in a file.  (This usually       happens when gcc's -gsplit-dwarf option is used).
      In addition objdump's --dwarf=follow-links now also affects its       other display options, so that for example, when combined with
      --syms it will cause the symbol tables in any linked debug info       files to also be displayed.  In addition when combined with
      --disassemble the --dwarf= follow-links option will ensure that       any symbol tables in the linked files are read and used when       disassembling code in the main file.
    * Add support for dumping types encoded in the Compact Type Format       to objdump and readelf.

    The following security fixes are addressed by the update:

    - CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452).
    - CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c     (bsc#1183511).
    - CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory     consumption in bfd's dwarf2.c read_section() (bsc#1184620).
    - CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794).
    - CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898).
    - CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899).
    - CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900).
    - CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901).
    - CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902).
    - CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903)
    - CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c     via crafted PEF file (bsc#1180451).
    - CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value     of bfd_malloc (bsc#1180454).
    - CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461).
    - CVE-2019-17451: Fixed an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line() in     dwarf2.c (bsc#1153768).
    - CVE-2019-17450: Fixed a potential denial of service in find_abstract_instance() in dwarf2.c     (bsc#1153770).
    - CVE-2019-9077: Fixed a heap-based buffer overflow in process_mips_specific() in readelf.c via a     malformed MIPS option section (bsc#1126826).
    - CVE-2019-9075: Fixed a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap() in archive64.c     (bsc#1126829).
    - CVE-2019-9074: Fixed a out-of-bounds read leading to a SEGV in bfd_getl32() in libbfd.c (bsc#1126831).
    - CVE-2019-12972: Fixed a heap-based buffer over-read in _bfd_doprnt() in bfd.c (bsc#1140126).
    - CVE-2019-14444: Fixed an integer overflow apply_relocations() in readelf.c (bsc#1143609).
    - CVE-2019-14250: Fixed an integer overflow in simple_object_elf_match() in simple-object-elf.c     (bsc#1142649).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4336-1 advisory.

    It was discovered that GNU binutils contained a large number of security issues. If a user or automated     system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils     to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for binutils fixes the following issues :

binutils was updated to version 2.35. (jsc#ECO-2373)

Update to binutils 2.35 :

  - The assembler can now produce DWARF-5 format line number     tables.

  - Readelf now has a 'lint' mode to enable extra checks of     the files it is processing.

  - Readelf will now display '[...]' when it has to truncate     a symbol name. The old behaviour - of displaying as many     characters as possible, up to the 80 column limit - can     be restored by the use of the --silent-truncation     option.

  - The linker can now produce a dependency file listing the     inputs that it has processed, much like the -M -MP     option supported by the compiler.

  - fix DT_NEEDED order with -flto [bsc#1163744]

Update to binutils 2.34 :

  - The disassembler (objdump --disassemble) now has an     option to generate ascii art thats show the arcs between     that start and end points of control flow instructions.

  - The binutils tools now have support for debuginfod.
    Debuginfod is a HTTP service for distributing ELF/DWARF     debugging information as well as source code. The tools     can now connect to debuginfod servers in order to     download debug information about the files that they are     processing.

  - The assembler and linker now support the generation of     ELF format files for the Z80 architecture.

  - Add new subpackages for libctf and libctf-nobfd.

  - Disable LTO due to bsc#1163333.

  - Includes fixes for these CVEs: bsc#1153768 aka     CVE-2019-17451 aka PR25070 bsc#1153770 aka     CVE-2019-17450 aka PR25078

  - fix various build fails on aarch64 (PR25210,     bsc#1157755).

Update to binutils 2.33.1 :

  - Adds support for the Arm Scalable Vector Extension     version 2 (SVE2) instructions, the Arm Transactional     Memory Extension (TME) instructions and the Armv8.1-M     Mainline and M-profile Vector Extension (MVE)     instructions.

  - Adds support for the Arm Cortex-A76AE, Cortex-A77 and     Cortex-M35P processors and the AArch64 Cortex-A34,     Cortex-A65, Cortex-A65AE, Cortex-A76AE, and Cortex-A77     processors.

  - Adds a .float16 directive for both Arm and AArch64 to     allow encoding of 16-bit floating point literals.

  - For MIPS, Add -m[no-]fix-loongson3-llsc option to fix     (or not) Loongson3 LLSC Errata. Add a
    --enable-mips-fix-loongson3-llsc=[yes|no] configure time     option to set the default behavior. Set the default if     the configure option is not used to 'no'.

  - The Cortex-A53 Erratum 843419 workaround now supports a     choice of which workaround to use. The option
    --fix-cortex-a53-843419 now takes an optional argument
    --fix-cortex-a53-843419[=full|adr|adrp] which can be     used to force a particular workaround to be used. See
    --help for AArch64 for more details.

  - Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and     GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program     properties in the AArch64 ELF linker. 

  - Add -z force-bti for AArch64 to enable     GNU_PROPERTY_AARCH64_FEATURE_1_BTI on output while     warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI     on inputs and use PLTs protected with BTI.

  - Add -z pac-plt for AArch64 to pick PAC enabled PLTs.

  - Add --source-comment[=<txt>] option to objdump which if     present, provides a prefix to source code lines     displayed in a disassembly.

  - Add --set-section-alignment     <section-name>=<power-of-2-align> option to objcopy to     allow the changing of section alignments.

  - Add --verilog-data-width option to objcopy for verilog     targets to control width of data elements in verilog hex     format.

  - The separate debug info file options of readelf     (--debug-dump=links and --debug-dump=follow) and objdump     (--dwarf=links and

    --dwarf=follow-links) will now display and/or follow     multiple links if more than one are present in a file.
    (This usually happens when gcc's -gsplit-dwarf option is     used). In addition objdump's --dwarf=follow-links now     also affects its other display options, so that for     example, when combined with

    --syms it will cause the symbol tables in any linked     debug info files to also be displayed. In addition when     combined with

    --disassemble the --dwarf= follow-links option will     ensure that any symbol tables in the linked files are     read and used when disassembling code in the main file.

  - Add support for dumping types encoded in the Compact     Type Format to objdump and readelf.

  - Includes fixes for these CVEs: bsc#1126826 aka     CVE-2019-9077 aka PR1126826 bsc#1126829 aka     CVE-2019-9075 aka PR1126829 bsc#1126831 aka     CVE-2019-9074 aka PR24235 bsc#1140126 aka CVE-2019-12972     aka PR23405 bsc#1143609 aka CVE-2019-14444 aka PR24829     bsc#1142649 aka CVE-2019-14250 aka PR90924

  - Add xBPF target

  - Fix various problems with DWARF 5 support in gas

  - fix nm -B for objects compiled with -flto and -fcommon.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0120 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-1010204:
    GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation,     Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is:
    gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff     header field must be opened.

    CVE-2019-14250:
    An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in     simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant     heap-based buffer overflow.

    CVE-2019-14444:
    apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to     trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as     demonstrated by readelf.

    CVE-2019-17450:
    find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file.

    CVE-2019-17451:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c,     as demonstrated by nm.

    CVE-2019-9071:
    An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption     issue in d_count_templates_scopes in cp-demangle.c after many recursive calls.

    CVE-2019-9073:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory allocation in _bfd_elf_slurp_version_tables in elf.c.

    CVE-2019-9074:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in pei-x86_64.c.

    CVE-2019-9075:
    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.

    CVE-2019-9077:
    An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific     in readelf.c via a malformed MIPS option section.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4336-2 advisory.

    USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides the corresponding update     for Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a     SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as     demonstrated by nm.(CVE-2019-17451)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

  - The process_version_sections function in readelf.c in     GNU Binutils 2.29 allows attackers to cause a denial of     service (Integer Overflow, and hang because of a     time-consuming loop) or possibly have unspecified other     impact via a crafted binary file with invalid values of     ent.vn_next, during 'readelf -a'     execution.(CVE-2017-14333)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

  - A flaw exists in binutils in bfd/pef.c. An attacker who     is able to submit a crafted PEF file to be parsed by     objdump could cause a heap buffer overflow ->     out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils     versions prior to 2.34.(CVE-2020-35493)

  - There's a flaw in binutils /opcodes/tic4x-dis.c. An     attacker who is able to submit a crafted input file to     be processed by binutils could cause usage of     uninitialized memory. The highest threat is to     application availability with a lower threat to data     confidentiality. This flaw affects binutils versions     prior to 2.34.(CVE-2020-35494)

  - find_abstract_instance in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed     in GNU Binutils 2.32, allows remote attackers to cause     a denial of service (infinite recursion and application     crash) via a crafted ELF file.(CVE-2019-17450)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4465 advisory.

  - binutils: denial of service via crafted ELF file (CVE-2019-17450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-39 (Binutils: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Binutils. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4465 advisory.

    The binutils packages provide a collection of binary utilities for the manipulation of object code in     various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf,     size, strings, strip, and addr2line utilities.

    Security Fix(es):

    * binutils: denial of service via crafted ELF file (CVE-2019-17450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4465 advisory.

    [2.30-79.0.1]
    - Forward-port Oracle patches from 2.30-75.0.1
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.30-79]
    - Fix x86 assemblers handling of non-8-bit displacements.  (#1869401)

    [2.30-77]
    - Add tests missing from PT_GNU_SEGMENT patch.  (#1870039)

    [2.30-75.0.1]
    - Forward-port Oracle patches to OL8.3 beta.

    [2.30-76]
    - Have the s.390 assembler include alignment hints with vector instructions.  (#1850490)

    [2.30-75]
    - Prevent the s/390 linker from rewriting the GOT access for certain symbol types.  (#1846972)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/20	critical
148067	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-1670)	Nessus	Huawei Local Security Checks	2021/3/24	2024/1/8	medium
157597	AlmaLinux 8 : binutils (ALSA-2020:4465)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	medium
154861	SUSE SLED12: binutils / binutils-devel / binutils-gold / cross-ppc-binutils / etc (SUSE-SU-2021:3593-1)	Nessus	SuSE Local Security Checks	2021/11/3	2026/6/25	high
135966	Ubuntu 18.04 LTS : GNU binutils vulnerabilities (USN-4336-1)	Nessus	Ubuntu Local Security Checks	2020/4/24	2024/8/27	critical
142149	openSUSE Security Update : binutils (openSUSE-2020-1804)	Nessus	SuSE Local Security Checks	2020/11/2	2024/2/13	high
142163	openSUSE Security Update : binutils (openSUSE-2020-1790)	Nessus	SuSE Local Security Checks	2020/11/2	2024/2/13	high
236727	Alibaba Cloud Linux 3 : 0120: binutils (ALINUX3-SA-2022:0120)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
151919	Ubuntu 16.04 ESM : GNU binutils vulnerabilities (USN-4336-2)	Nessus	Ubuntu Local Security Checks	2021/7/21	2024/10/29	critical
222723	Linux Distros Unpatched Vulnerability : CVE-2019-17450	Nessus	Misc.	2025/3/4	2026/7/18	medium
146710	EulerOS 2.0 SP2 : binutils (EulerOS-SA-2021-1282)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	medium
149165	EulerOS 2.0 SP3 : binutils (EulerOS-SA-2021-1767)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/2	high
147451	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2021-1459)	Nessus	Huawei Local Security Checks	2021/3/10	2024/1/11	medium
145890	CentOS 8 : binutils (CESA-2020:4465)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	medium
138962	GLSA-202007-39 : Binutils: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	medium
143093	RHEL 8 : binutils (RHSA-2020:4465)	Nessus	Red Hat Local Security Checks	2020/11/19	2024/11/7	medium
142811	Oracle Linux 8 : binutils (ELSA-2020-4465)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/10/22	medium

检测

插件搜索

critical

medium

medium

high

critical

high

high

high

critical

medium

medium

high

medium

medium

medium

medium

medium