Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 8 articles for you...
202
security advisoryheap overflowlowopenSUSE 16.0 NASM Low Heap Overflow and Use After Free 2026-21333-1
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.. openSUSE security update: security update for nasm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21333-1 Rating: low References: * bsc#1261985 * bsc#1261986 Cross-References: * CVE-2026-6067 * CVE-2026-6068 CVSS scores: * CVE-2026-6067 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-6067 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-6068 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-6068 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed. Description: This update for nasm fixes the following issues - CVE-2026-6067: heap buffer overflow vulnerability due to a lack of bounds checking in the obj_directive() function (bsc#1261986). - CVE-2026-6068: heap use after free vulnerability in response file processing (bsc#1261985). Changes for nasm: - Update to 3.02: * Fix build problems on C23 compilers using a pre-C23 version of which defines bool as a macro in violation of the C23 specification. * The immediate form of the JMPE instruction (opcode 0F B8) has been changed to an absolute address, as in the Itanium Architecture Software Developer's Manual, version 2.3, Volume 4, page 4:249. Hopefully this won't break whatever virtual environments use JMPE, but it is the closest thing there is to an official specification for this opcode. * Being an absolute address, treat it equivalent to a FAR jump and do not default to 64 bits in 64-bit mode. * That JMPE has apparently been wrong all these years is probably as good of a hint as any how much it has been actually used, but it does have the possibility of breaking virtual environments. Inthat case, please file a bug report to https://bugs.nasm.us with details about the virtual environment, and we will figure out a suitable solution. * Various build fixes. Fix the documentation not building on MacOS because of the cp utility lacking -u there. Also fix not building generally due to wrong link formatting. Another fix was a typo in compiler.h related to a C++ check. * Corrections to assembling encodings: + Fix CMP allowing LOCK which is illegal. + Correct multiple AVX512 instructions such as VCVTSD2SI, VCVTSD2USI, VCVTSS2SI, VCVTSS2USI, VCVTTSD2SI, VCVTTSD2USI, VCVTTSS2SI, VCVTTSS2USI, VGETEXPSH, VGETMANTSH, MOVDDUP, VMOVDDUP. + Fixed other encodings or instruction formats for instructions UWRMSR, CMPSD, VCMPSS, V4FMADDSS, V4FNMADDSS, VCVTDQ2PH, VCVTPD2PH, VCVTPH2UDQ, VCVTQQ2PH, VCVTUDQ2PH, VCVTUQQ2PH, VGETEXPSH, VGETMANTSH, VRCPPH, VRSQRTPH, VCVTPH2BF8, VCVTPH2BF8S, VCVTPH2HF8, VCVTPH2HF8S. + Fixed typos in VP4DPWSSD mnemonic. + Fixed BYTE and WORD operands getting the same encoding on arithmetic instructions such as CMP. + Fixed PUSH not assembling when used with a DWORD in 64-bit mode. This is not a recommended syntax as the operand size is still 64 bits, but was permitted by earlier versions of NASM. + Fix parsing of $--escaped symbols in directives (GLOBAL, STATIC, EXTERN, REQUIRED, COMMON). * Corrections to disassembling: + Shift instructions with the unity operand were getting disassembled to a zero operand instead of one. + JMP, CALL and JMPE disassembled incorrectly with the register operands. * Whole bunch of minor fixes to operand sizes, operand size prefixes. Changes mostly return the behavior known from 2.16.03. * MOV [mem], label would be accepted without size specifiers which could cause unintended consequences. Raise an error if no size was specified and one of the operands is a memory reference and another operands is a label. * JMP NEAR is now the same as JMP STRICT NEAR as the STRICT is redundant here. JMP WORD on the other hand is up foroptimization as NEAR and WORD relate to different things -- jump lengths and operation sizes respectively. * Using redundant (or not) but valid operands size prefixes was fixed on instructions such as IRET, PUSHF, POPF, PUSH and POP. * Using an operand size prefix on a JMP or CALL instruction could generate an invalid instruction. This appears to have been a long-standing bug. Specifying the operand size by specifying the size of the immediate explicitly (e.g. JMP DWORD label) has always worked correctly, however. * Add support for C2y-style \o escape sequences, braced escape sequences, and as NASM extensions, decimal escape sequences (\d) and control-character escape sequences (\^). See section 3.4.2. * Fix generation of the short opcodes for ADD, OR, ADC, SBB, AND, SUB, XOR, and CMP AL,imm8. * Fix truncation of the generated constant to 63 bits when invoking a single-line macro when an argument is defined as =/b or =/ub. * Add an %env() preprocessor function as a more robust and flexible alternative to the %! construct. See section 5.5.7. * The maximum number of multi-line macro parameters is now a configurable limit. See section 2.1.32. * The --limit- options and %pragma limit now accept the keywords default, maximum, and reset. See section 2.1.32. * Fix parsing of seg:offs--style FAR pointers in EQU. * Fix the %clear preprocessor directive hanging when given parameters. * The never properly implemented (or documented) preprocessor directives %rmacro and %irmacro are now properly disabled; to avoid breaking existing code, they fall back to %macro and %imacro with a suitable warning. Programmers should not rely on this behavior: in the future, these directives might actually be (properly) implemented. * New listing option -Lc to include the contents of INCBIN files, see section 2.1.4. * New listing option -Lt to include the output from every iteration of TIMES and ALIGN directives, see section 2.1.4. * The %pragma list options directive now support resetting options to their command-line default, see section 2.1.4. * New predefined macros __?LIST_OPTIONS?__ and __?LIST_OPTIONS_DEFAULT?__ to query the active and command-line default listing options. See section 2.1.4. - Update to 3.01: * A new obj2 version of the obj output format, intended for use on OS/2. See section 9.5. * The condition after %if or %elif would be evaluated while output is suppressed after %exitrep or %exitmacro. Although no output would be generated in either case, assembly would fail if evaluating the expression triggered an error. * Fix encoding of TCVTROWPS2PHL, correct multiple AVX512-BF16 instructions' operand formats and typoed mnemonics. * The unofficial but obvious alternate form TEST reg,mem was not accepted by NASM 3.00; corrected. * For the obj output format, multiple GROUP directives can now be specified for the same group; the resulting group includes all sections specified in all GROUP directives for the group. * A new %selbits() preprocessor function. See section 5.4.19. * A new --bits option as convenience shorthand for --before "BITS ...". See section 2.1.31. * The options and pragmas for configuring external label mangling were inconsistent, the former using the spelling postfix and the latter suffix. Furthermore, these were also documented as directives in addition to pragmas. Implement the already documented directives (bracketed forms only) and allow both postfix and suffix in all cases. See section 2.1.28 and section 8.10. * Define additional permissive patterns and fix several opcode bugs. * Fix parsing of two-operand forms of x87 instructions. * Fix bogus "absolute address can not be RIP-relative" warning. * Hopefully fix building with OpenWatcom. * Generate a warning, promoted to error by default, on the use of o64 prefixes in 16- or 32-bit mode. If demoted to a warning or suppressed the prefix is ignored, but likely will trigger subsequent, harder to debug, error messages. * More consistent handling of jump and call instructions with specified operandsizes. * Fix an operand size handling bug in the CMPXCHG instruction. - Update to 3.00: * Improve the documentation for building from source (appendix D). * Add support for the APX and AVX10 instruction sets, and various miscellaneous new instructions. * Add new preprocessor functions: %b2hs(), %chr(), %depend(), %find(), %findi(), %hs2b(), %null(), %ord(), %pathsearch(), and %realpath(). See section 5.4. * New preprocessor directive %note to insert a note in the list file, without issuing an external diagnosic. Unlike a comment, it is optionally macro-expanded, see section 5.11. * New preprocessor directive %iffile (and corresponding function %isfile()) to test for the existence of a file. See section 5.6.12. * New preprocessor directive %ifdirective to test for the existence of a preprocessor directive, assembly directive, or pseudo-instruction; see section 5.6.10. * Fix a number of invalid memory references (usually causing crashes) on various invalid inputs. * Fix multiple bugs in the handling of $--escaped symbols. * The use of $ as a prefix for hexadecimal numbers has been deprecated, and will now issue a warning. A new directive [DOLLARHEX] can be used to disable this syntax entirely, see section 8.12. * Fix the generation of segment selector references (mainly used in the obj output format.) * Fix crash in the obj backend when code was emitted into the default segment, without any labels having been defined. * Clean up the command-line help text (-h) and break it down into individual topics, as the previous output was just too verbose to be practical as a quick reference. * The implicit DEFAULT ABS in 64-bit mode is deprecated and may be changed to REL in the future. See section 8.2. A warning is now emitted for this condition. * It is now possible to set the REL/ABS default for memory accesses using FS: or GS:, see section 8.2. * The __?DEFAULT?__ standard macro now reflects the settings of the DEFAULT directive. See section 6.4. * The NASM preprocessor now assumes that anunknown directive starting with %if or %elif is a misspelled or not yet implemented conditional directive, and tries to match it with a corresponding %endif. See section 5.6.14. * The masm macro package now defines a macro for x87 register syntax. See section 7.5. * A new macro package, vtern, to simplify generation of the control immediates for the VPTERNLOGD and VPTERNLOGQ instructions. See section 7.6. * A new command line option -LF allows overriding [LIST -] directives. * In the obj output format, allow a segment in the FLAT pseudo-group to also belong to another (real) group. Used on OS/2. * Add a new build_version directive to the Mach-O backend. See section 9.8.6. * Fix a spec violation in the generation of DWARF debugging information on ELF. * Response files can now be nested. * Many documentation improvements. Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-1237=1 Package List: - openSUSE Leap 16.0: nasm-3.02-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2026-6067.html * https://www.suse.com/security/cve/CVE-2026-6068.html . A low-severity update for openSUSE addresses issues in nasm, including heap overflow and use-after-free vulnerabilities.. openSUSE update,nasm patch,heap overflow issue,security vulnerabilities. . Severity: Low. LinuxSecurity.com Team
Jul 15, 2026
•Low
OpenSUSE
202
security advisorymoderateOpenSUSEopenSUSE Tumbleweed nasm Moderate Security Fix for CVE-2026-6067
An update that solves 2 vulnerabilities can now be installed.. # nasm-3.02-1.1 on GA media Announcement ID: openSUSE-SU-2026:11217-1 Rating: moderate Cross-References: * CVE-2026-6067 * CVE-2026-6068 CVSS scores: * CVE-2026-6067 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-6067 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-6068 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-6068 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the nasm-3.02-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * nasm 3.02-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-6067.html * https://www.suse.com/security/cve/CVE-2026-6068.html . Discover the moderate security issues fixed in nasm-3.02-1.1 on openSUSE Tumbleweed with advisory ID 2026-11217-1.. nasm update, openSUSE security, moderate vulnerabilities. . Severity: moderate. LinuxSecurity.com Team
Jul 10, 2026
•moderate
OpenSUSE
89
security advisoryfedoraarbitrary code executionFedora 44 NASM Important CVE-2026-6067 Arbitrary Code Execution Fix
Fix for CVE-2026-6067 .. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-eaae48ece0 2026-06-07 00:55:32.282503+00:00 -------------------------------------------------------------------------------- Name : nasm Product : Fedora 44 Version : 3.01 Release : 3.fc44 URL : http://www.nasm.us Summary : A portable x86 assembler which uses Intel-like syntax Description : NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. -------------------------------------------------------------------------------- Update Information: Fix for CVE-2026-6067 . -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 22 2026 Dominik Mierzejewski - 3.01-3 - fix CVE-2026-6067 (resolves rhbz#2458087, rhbz#2458089) patch by Nick Clifton -------------------------------------------------------------------------------- References: [ 1 ] Bug #2458087 - CVE-2026-6067 nasm: Netwide Assembler (NASM): Arbitrary code execution via malicious assembly file processing [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2458087 [ 2 ] Bug #2458089 - CVE-2026-6067 nasm: Netwide Assembler (NASM): Arbitrary code execution via malicious assembly file processing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2458089 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-eaae48ece0' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 07, 2026
•Important
Fedora
89
security advisoryfedoraupdateFedora 44 nasm Important Code Execution Vulnern 2026-6067
Fix for CVE-2026-6067 .. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-eaae48ece0 2026-06-07 00:55:32.282503+00:00 -------------------------------------------------------------------------------- Name : nasm Product : Fedora 44 Version : 3.01 Release : 3.fc44 URL : http://www.nasm.us Summary : A portable x86 assembler which uses Intel-like syntax Description : NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. -------------------------------------------------------------------------------- Update Information: Fix for CVE-2026-6067 . -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 22 2026 Dominik Mierzejewski - 3.01-3 - fix CVE-2026-6067 (resolves rhbz#2458087, rhbz#2458089) patch by Nick Clifton -------------------------------------------------------------------------------- References: [ 1 ] Bug #2458087 - CVE-2026-6067 nasm: Netwide Assembler (NASM): Arbitrary code execution via malicious assembly file processing [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2458087 [ 2 ] Bug #2458089 - CVE-2026-6067 nasm: Netwide Assembler (NASM): Arbitrary code execution via malicious assembly file processing [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2458089 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-eaae48ece0' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 06, 2026
•Important
Fedora
172
security advisorydenial of serviceUbuntuUbuntu 24.04 LTS NASM Security Advisory USN-8248-2 CVE-2023-31722
USN-8248-1 introduced a regression in NASM. ========================================================================== Ubuntu Security Notice USN-8248-2 May 08, 2026 nasm regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: USN-8248-1 introduced a regression in NASM Software Description: - nasm: Netwide Assembler Details: USN-8248-1 fixed vulnerabilities in NASM. Unfortunately the update introduced a regression which could cause NASM to crash. This update fixes the problem by reverting the fix for CVE-2021-33450 and CVE-2021-33452 in Ubuntu 24.04 LTS. We apologize for the inconvenience. Original advisory details: Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow when handling certain input. An attacker could possibly use this issue to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-31722) It was discovered that NASM incorrectly handled memory allocation. An attacker could possibly use this issue to cause NASM to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS nasm 2.16.01-1ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8248-2 https://ubuntu.com/security/notices/USN-8248-1 CVE-2021-33450, CVE-2021-33452, https://launchpad.net/bugs/2151861 . Update addresses regression in NASM due to previous patches, ensuring stability on Ubuntu 24.04 LTS.. nasm Ubuntu 24.04 LTS security fix denial of service regression. . Severity: Important. LinuxSecurity.com Team
May 08, 2026
•Important
Ubuntu
172
security advisorydenial of servicecriticalUbuntu 24.04 LTS NASM Critical Heap Overflow Denial of Service USN-8248-1
Several security issues were fixed in NASM.. ========================================================================== Ubuntu Security Notice USN-8248-1 May 07, 2026 nasm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in NASM. Software Description: - nasm: Netwide Assembler Details: Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow when handling certain input. An attacker could possibly use this issue to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-31722) It was discovered that NASM incorrectly handled memory allocation. An attacker could possibly use this issue to cause NASM to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS nasm 2.16.01-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS nasm 2.15.05-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8248-1 CVE-2021-33450, CVE-2021-33452, CVE-2023-31722 . Multiple critical NASM issues fixed in Ubuntu. Ensure your systems are updated for complete protection.. Ubuntu Security, NASM Update, Heap Overflow, Denial of Service, Ubuntu 24.04. . Severity: Critical. LinuxSecurity.com Team
May 07, 2026
•Critical
Ubuntu
202
security advisorymoderatesecurity issueopenSUSE 15.1: openSUSE-SU-2020:0952-1 Moderate: nasm Security Issue
An update that solves 13 vulnerabilities and has one errata is now available.. openSUSE Security Update: Security update for nasm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0952-1 Rating: moderate References: #1084631 #1086186 #1086227 #1086228 #1090519 #1090840 #1106878 #1107592 #1107594 #1108404 #1115758 #1115774 #1115795 #1173538 Cross-References: CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254 CVE-2018-10316 CVE-2018-16382 CVE-2018-16517 CVE-2018-16999 CVE-2018-19214 CVE-2018-19215 CVE-2018-19216 CVE-2018-8881 CVE-2018-8882 CVE-2018-8883 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set thedependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON.Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-952=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): nasm-2.14.02-lp151.3.3.1 nasm-debuginfo-2.14.02-lp151.3.3.1 nasm-debugsource-2.14.02-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000667.html https://www.suse.com/security/cve/CVE-2018-10016.html https://www.suse.com/security/cve/CVE-2018-10254.html https://www.suse.com/security/cve/CVE-2018-10316.html https://www.suse.com/security/cve/CVE-2018-16382.html https://www.suse.com/security/cve/CVE-2018-16517.html https://www.suse.com/security/cve/CVE-2018-16999.html https://www.suse.com/security/cve/CVE-2018-19214.html https://www.suse.com/security/cve/CVE-2018-19215.html https://www.suse.com/security/cve/CVE-2018-19216.html https://www.suse.com/security/cve/CVE-2018-8881.html https://www.suse.com/security/cve/CVE-2018-8882.html https://www.suse.com/security/cve/CVE-2018-8883.html https://bugzilla.suse.com/1084631 https://bugzilla.suse.com/1086186 https://bugzilla.suse.com/1086227 https://bugzilla.suse.com/1086228 https://bugzilla.suse.com/1090519 https://bugzilla.suse.com/1090840 https://bugzilla.suse.com/1106878 https://bugzilla.suse.com/1107592 https://bugzilla.suse.com/1107594 https://bugzilla.suse.com/1108404 https://bugzilla.suse.com/1115758 https://bugzilla.suse.com/1115774 https://bugzilla.suse.com/1115795 https://bugzilla.suse.com/1173538 -- . openSUSE Security Update: Security update for nasm _________________________________________________. update, solves, vulnerabilities, errata, opensuse, security. . LinuxSecurity.com Team
Jul 13, 2020
OpenSUSE
202
security advisorymoderatesoftware updateopenSUSE Leap 15.2: 2020:0954-1 Moderate: nasm Issue Fix
An update that solves 13 vulnerabilities and has one errata is now available.. openSUSE Security Update: Security update for nasm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0954-1 Rating: moderate References: #1084631 #1086186 #1086227 #1086228 #1090519 #1090840 #1106878 #1107592 #1107594 #1108404 #1115758 #1115774 #1115795 #1173538 Cross-References: CVE-2018-1000667 CVE-2018-10016 CVE-2018-10254 CVE-2018-10316 CVE-2018-16382 CVE-2018-16517 CVE-2018-16999 CVE-2018-19214 CVE-2018-19215 CVE-2018-19216 CVE-2018-8881 CVE-2018-8882 CVE-2018-8883 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has one errata is now available. Description: This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set thedependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON.Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-954=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): nasm-2.14.02-lp152.4.3.1 nasm-debuginfo-2.14.02-lp152.4.3.1 nasm-debugsource-2.14.02-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000667.html https://www.suse.com/security/cve/CVE-2018-10016.html https://www.suse.com/security/cve/CVE-2018-10254.html https://www.suse.com/security/cve/CVE-2018-10316.html https://www.suse.com/security/cve/CVE-2018-16382.html https://www.suse.com/security/cve/CVE-2018-16517.html https://www.suse.com/security/cve/CVE-2018-16999.html https://www.suse.com/security/cve/CVE-2018-19214.html https://www.suse.com/security/cve/CVE-2018-19215.html https://www.suse.com/security/cve/CVE-2018-19216.html https://www.suse.com/security/cve/CVE-2018-8881.html https://www.suse.com/security/cve/CVE-2018-8882.html https://www.suse.com/security/cve/CVE-2018-8883.html https://bugzilla.suse.com/1084631 https://bugzilla.suse.com/1086186 https://bugzilla.suse.com/1086227 https://bugzilla.suse.com/1086228 https://bugzilla.suse.com/1090519 https://bugzilla.suse.com/1090840 https://bugzilla.suse.com/1106878 https://bugzilla.suse.com/1107592 https://bugzilla.suse.com/1107594 https://bugzilla.suse.com/1108404 https://bugzilla.suse.com/1115758 https://bugzilla.suse.com/1115774 https://bugzilla.suse.com/1115795 https://bugzilla.suse.com/1173538 -- . openSUSE Security Update: Security update for nasm _________________________________________________. update, solves, vulnerabilities, errata, opensuse, security. . LinuxSecurity.com Team
Jul 13, 2020
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!