Ubuntu 14.10: 2496-1 Severe: GNU Binutils Multiple Issues

ubuntu

February 9, 2015

Applications from GNU binutils could be made to crash, run programs, or delete arbitrary files as your login if they opened a specially crafted file.

Summary

Applications from GNU binutils could be made to crash, run programs,

or delete arbitrary files as your login if they opened a specially

crafted file.

Software Description:

- binutils: GNU assembler, linker and binary utilities

Details:

Michal Zalewski discovered that the setup_group function in libbfd in

GNU binutils did not properly check group headers in ELF files. An

attacker could use this to craft input that could cause a denial

of service (application crash) or possibly execute arbitrary code.

(CVE-2014-8485)

Hanno Böck discovered that the _bfd_XXi_swap_aouthdr_in function

in libbfd in GNU binutils allowed out-of-bounds writes. An

attacker could use this to craft input that could cause a denial

of service (application crash) or possibly execute arbitrary code.

(CVE-2014-8501)

Hanno Böck discovered a heap-based buffer overflow in the

pe_print_edata function in libbfd in GNU binutils. An attacker

could use this to craft input that could cause a de...

Read the Full Advisory

Topics Covered

security advisory code execution Ubuntu application crash GNU Binutils

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  binutils                        2.24.90.20141014-0ubuntu3.1
  binutils-multiarch              2.24.90.20141014-0ubuntu3.1

Ubuntu 14.04 LTS:
  binutils                        2.24-5ubuntu3.1
  binutils-multiarch              2.24-5ubuntu3.1

Ubuntu 12.04 LTS:
  binutils                        2.22-6ubuntu1.2
  binutils-multiarch              2.22-6ubuntu1.2

Ubuntu 10.04 LTS:
  binutils                        2.20.1-3ubuntu7.2
  binutils-multiarch              2.20.1-3ubuntu7.2

In general, a standard system update will make all the necessary changes.