SUSE Security Update: Security update for nasm
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:1843-1
Rating:             moderate
References:         #1084631 #1086186 #1086227 #1086228 #1090519 
                    #1090840 #1106878 #1107592 #1107594 #1108404 
                    #1115758 #1115774 #1115795 #1173538 
Cross-References:   CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254
                    CVE-2018-10316 CVE-2018-16382 CVE-2018-16517
                    CVE-2018-16999 CVE-2018-19214 CVE-2018-19215
                    CVE-2018-19216 CVE-2018-8881 CVE-2018-8882
                    CVE-2018-8883
Affected Products:
                    SUSE Linux Enterprise Module for Development Tools 15-SP2
                    SUSE Linux Enterprise Module for Development Tools 15-SP1
______________________________________________________________________________

   An update that solves 13 vulnerabilities and has one errata
   is now available.

Description:


   This update for nasm fixes the following issues:

   nasm was updated to version 2.14.02.

   This allows building of Mozilla Firefox 78ESR and also contains lots of
   bugfixes, security fixes and improvements.

   * Fix crash due to multiple errors or warnings during the code generation
     pass if a list file is specified.
   * Create all system-defined macros defore processing command-line given
     preprocessing directives (-p, -d, -u, --pragma, --before).
   * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See
     section 4.11.7.
   * Fix an assert for the case in the obj format when a SEG operator refers     to an EXTERN symbol declared further down in the code.
   * Fix a corner case in the floating-point code where a binary, octal or
     hexadecimal floating-point having at least 32, 11, or 8 mantissa digits
     could produce slightly incorrect results under very specific conditions.
   * Support -MD without a filename, for gcc compatibility. -MF can be used
     to set the dependencies output filename. See section 2.1.7.
   * Fix -E in combination with -MD. See section 2.1.21.
   * Fix missing errors on redefined labels; would cause convergence failure
     instead which is very slow and not easy to debug.
   * Duplicate definitions of the same label with the same value is now
     explicitly permitted (2.14 would allow it in some circumstances.)
   * Add the option --no-line to ignore %line directives in the source. See
     section 2.1.33 and section 4.10.1.
   * Changed -I option semantics by adding a trailing path separator
     unconditionally.
   * Fixed null dereference in corrupted invalid single line macros.
   * Fixed division by zero which may happen if source code is malformed.
   * Fixed out of bound access in processing of malformed segment override.
   * Fixed out of bound access in certain EQU parsing.
   * Fixed buffer underflow in float parsing.
   * Added SGX (Intel Software Guard Extensions) instructions.
   * Added +n syntax for multiple contiguous registers.
   * Fixed subsections_via_symbols for macho object format.
   * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line
     options, to allow command line base symbol renaming. See section 2.1.28.
   * Allow label renaming to be specified by %pragma in addition to from the
     command line. See section 6.9.
   * Supported generic %pragma namespaces, output and debug. See section 6.10.
   * Added the --pragma command line option to inject a %pragma directive.
     See section 2.1.29.
   * Added the --before command line option to accept preprocess statement
     before input. See section 2.1.30.
   * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural
     Network), BITALG (Bit Algorithm), and GFNI (Galois Field New
     Instruction) instructions.
   * Added the STATIC directive for local symbols that should be renamed
     using global-symbol rules. See section 6.8.
   * Allow a symbol to be defined as EXTERN and then later overridden as
     GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined
     will be treated as GLOBAL. See section 6.5.
   * The GLOBAL directive no longer is required to precede the definition of
     the symbol.
   * Support private_extern as macho specific extension to the GLOBAL
     directive. See section 7.8.5.
   * Updated UD0 encoding to match with the specification
   * Added the --limit-X command line option to set execution limits. See
     section 2.1.31.
   * Updated the Codeview version number to be aligned with MASM.
   * Added the --keep-all command line option to preserve output files. See
     section 2.1.32.
   * Added the --include command line option, an alias to -P (section 2.1.18).
   * Added the --help command line option as an alias to -h (section 3.1).
   * Added -W, -D, and -Q suffix aliases for RET instructions so the operand
     sizes of these instructions can be encoded without using o16, o32 or o64.

   New upstream version 2.13.03:

   * Add flags: AES, VAES, VPCLMULQDQ
   * Add VPCLMULQDQ instruction
   * elf: Add missing dwarf loc section
   * documentation updates


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Development Tools 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2020-1843=1

   - SUSE Linux Enterprise Module for Development Tools 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2020-1843=1



Package List:

   - SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 ppc64le s390x x86_64):

      nasm-2.14.02-3.4.1
      nasm-debuginfo-2.14.02-3.4.1
      nasm-debugsource-2.14.02-3.4.1

   - SUSE Linux Enterprise Module for Development Tools 15-SP1 (aarch64 ppc64le s390x x86_64):

      nasm-2.14.02-3.4.1
      nasm-debuginfo-2.14.02-3.4.1
      nasm-debugsource-2.14.02-3.4.1


References:

   https://www.suse.com/security/cve/CVE-2018-1000667.html
   https://www.suse.com/security/cve/CVE-2018-10016.html
   https://www.suse.com/security/cve/CVE-2018-10254.html
   https://www.suse.com/security/cve/CVE-2018-10316.html
   https://www.suse.com/security/cve/CVE-2018-16382.html
   https://www.suse.com/security/cve/CVE-2018-16517.html
   https://www.suse.com/security/cve/CVE-2018-16999.html
   https://www.suse.com/security/cve/CVE-2018-19214.html
   https://www.suse.com/security/cve/CVE-2018-19215.html
   https://www.suse.com/security/cve/CVE-2018-19216.html
   https://www.suse.com/security/cve/CVE-2018-8881.html
   https://www.suse.com/security/cve/CVE-2018-8882.html
   https://www.suse.com/security/cve/CVE-2018-8883.html
   https://bugzilla.suse.com/1084631
   https://bugzilla.suse.com/1086186
   https://bugzilla.suse.com/1086227
   https://bugzilla.suse.com/1086228
   https://bugzilla.suse.com/1090519
   https://bugzilla.suse.com/1090840
   https://bugzilla.suse.com/1106878
   https://bugzilla.suse.com/1107592
   https://bugzilla.suse.com/1107594
   https://bugzilla.suse.com/1108404
   https://bugzilla.suse.com/1115758
   https://bugzilla.suse.com/1115774
   https://bugzilla.suse.com/1115795
   https://bugzilla.suse.com/1173538

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2020:1843-1 moderate: nasm

July 6, 2020
An update that solves 13 vulnerabilities and has one errata is now available

Summary

This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Development Tools 15-SP2: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2020-1843=1 - SUSE Linux Enterprise Module for Development Tools 15-SP1: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2020-1843=1 Package List: - SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 ppc64le s390x x86_64): nasm-2.14.02-3.4.1 nasm-debuginfo-2.14.02-3.4.1 nasm-debugsource-2.14.02-3.4.1 - SUSE Linux Enterprise Module for Development Tools 15-SP1 (aarch64 ppc64le s390x x86_64): nasm-2.14.02-3.4.1 nasm-debuginfo-2.14.02-3.4.1 nasm-debugsource-2.14.02-3.4.1

References

#1084631 #1086186 #1086227 #1086228 #1090519

#1090840 #1106878 #1107592 #1107594 #1108404

#1115758 #1115774 #1115795 #1173538

Cross- CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254

CVE-2018-10316 CVE-2018-16382 CVE-2018-16517

CVE-2018-16999 CVE-2018-19214 CVE-2018-19215

CVE-2018-19216 CVE-2018-8881 CVE-2018-8882

CVE-2018-8883

Affected Products:

SUSE Linux Enterprise Module for Development Tools 15-SP2

SUSE Linux Enterprise Module for Development Tools 15-SP1

https://www.suse.com/security/cve/CVE-2018-1000667.html

https://www.suse.com/security/cve/CVE-2018-10016.html

https://www.suse.com/security/cve/CVE-2018-10254.html

https://www.suse.com/security/cve/CVE-2018-10316.html

https://www.suse.com/security/cve/CVE-2018-16382.html

https://www.suse.com/security/cve/CVE-2018-16517.html

https://www.suse.com/security/cve/CVE-2018-16999.html

https://www.suse.com/security/cve/CVE-2018-19214.html

https://www.suse.com/security/cve/CVE-2018-19215.html

https://www.suse.com/security/cve/CVE-2018-19216.html

https://www.suse.com/security/cve/CVE-2018-8881.html

https://www.suse.com/security/cve/CVE-2018-8882.html

https://www.suse.com/security/cve/CVE-2018-8883.html

https://bugzilla.suse.com/1084631

https://bugzilla.suse.com/1086186

https://bugzilla.suse.com/1086227

https://bugzilla.suse.com/1086228

https://bugzilla.suse.com/1090519

https://bugzilla.suse.com/1090840

https://bugzilla.suse.com/1106878

https://bugzilla.suse.com/1107592

https://bugzilla.suse.com/1107594

https://bugzilla.suse.com/1108404

https://bugzilla.suse.com/1115758

https://bugzilla.suse.com/1115774

https://bugzilla.suse.com/1115795

https://bugzilla.suse.com/1173538

Severity
Announcement ID: SUSE-SU-2020:1843-1
Rating: moderate

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved