The remote host is affected by the vulnerability described in GLSA-202107-24 (Binutils: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Binutils. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4364 advisory.

    [2.30-108.0.2]
    - Forward-port the following update:
      [2.30-93.0.4
      - Backport fix for fencepost bug in CTF pptrtab usage causing coredumps
      - Backport test result fixes for new GCC-based CTF generation         [Orabug: 33344570]
      - Reviewed-by: David Faust <david.faust@oracle.com>
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.30-108.0.1]
    - Forward-port Oracle patches from 2.30-93.0.3 to 2.30-108.0.1
    - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has binutils packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the     following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

  - The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a     denial of service (integer overflow and application crash) or possibly have unspecified other impact via a     crafted ELF file, as demonstrated by objdump. (CVE-2018-7643)

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.
    (CVE-2018-10372)

  - concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in     GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as demonstrated by nm-new. (CVE-2018-10373)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with     an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address     exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy     copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. (CVE-2018-10534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3616-1 advisory.

    Update to binutils 2.37:

    * The GNU Binutils sources now requires a C99 compiler and library to       build.
    * Support for Realm Management Extension (RME) for AArch64 has been       added.
    * A new linker option '-z report-relative-reloc' for x86 ELF targets       has been added to report dynamic relative relocations.
    * A new linker option '-z start-stop-gc' has been added to disable       special treatment of __start_*/__stop_* references when
      --gc-sections.
    * A new linker options '-Bno-symbolic' has been added which will       cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
    * The readelf tool has a new command line option which can be used to       specify how the numeric values of symbols are reported.
      --sym-base=0|8|10|16 tells readelf to display the values in base 8,       base 10 or base 16.  A sym base of 0 represents the default action       of displaying values under 10000 in base 10 and values above that in       base 16.
    * A new format has been added to the nm program.  Specifying       '--format=just-symbols' (or just using -j) will tell the program to       only display symbol names and nothing else.
    * A new command line option '--keep-section-symbols' has been added to       objcopy and strip.  This stops the removal of unused section symbols       when the file is copied.  Removing these symbols saves space, but       sometimes they are needed by other tools.
    * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options       supported by objcopy now make undefined symbols weak on targets that       support weak symbols.
    * Readelf and objdump can now display and use the contents of .debug_sup       sections.
    * Readelf and objdump will now follow links to separate debug info       files by default.  This behaviour can be stopped via the use of the       new '-wN' or '--debug-dump=no-follow-links' options for readelf and       the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also       the old behaviour can be restored by the use of the       '--enable-follow-debug-links=no' configure time option.

      The semantics of the =follow-links option have also been slightly       changed.  When enabled, the option allows for the loading of symbol       tables and string tables from the separate files which can be used       to enhance the information displayed when dumping other sections,       but it does not automatically imply that information from the       separate files should be displayed.

      If other debug section display options are also enabled (eg       '--debug-dump=info') then the contents of matching sections in both       the main file and the separate debuginfo file *will* be displayed.
      This is because in most cases the debug section will only be present       in one of the files.

      If however non-debug section display options are enabled (eg       '--sections') then the contents of matching parts of the separate       debuginfo file will *not* be displayed.  This is because in most       cases the user probably only wanted to load the symbol information       from the separate debuginfo file.  In order to change this behaviour       a new command line option --process-links can be used.  This will       allow di0pslay options to applied to both the main file and any       separate debuginfo files.

    * Nm has a new command line option: '--quiet'.  This suppresses 'no       symbols' diagnostic.

    Update to binutils 2.36:

    New features in the Assembler:

    - General:

       * When setting the link order attribute of ELF sections, it is now          possible to use a numeric section index instead of symbol name.
       * Added a .nop directive to generate a single no-op instruction in          a target neutral manner.  This instruction does have an effect on          DWARF line number generation, if that is active.
       * Removed --reduce-memory-overheads and --hash-size as gas now          uses hash tables that can be expand and shrink automatically.

    - X86/x86_64:

       * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key          Locker instructions.
       * Support non-absolute segment values for lcall and ljmp.
       * Add {disp16} pseudo prefix to x86 assembler.
       * Configure with --enable-x86-used-note by default for Linux/x86.

    -  ARM/AArch64:

       * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,          Cortex-R82, Neoverse V1, and Neoverse N2 cores.
       * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded          Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call          Stack Recorder Extension) and BRBE (Branch Record Buffer          Extension) system registers.
       * Add support for Armv8-R and Armv8.7-A ISA extensions.
       * Add support for DSB memory nXS barrier, WFET and WFIT          instruction for Armv8.7.
       * Add support for +csre feature for -march. Add CSR PDEC          instruction for CSRE feature in AArch64.
       * Add support for +flagm feature for -march in Armv8.4 AArch64.
       * Add support for +ls64 feature for -march in Armv8.7          AArch64. Add atomic 64-byte load/store instructions for this          feature.
       * Add support for +pauth (Pointer Authentication) feature for
         -march in AArch64.

    New features in the Linker:

      * Add --error-handling-script=<NAME> command line option to allow         a helper script to be invoked when an undefined symbol or a         missing library is encountered.  This option can be suppressed         via the configure time switch: --enable-error-handling-script=no.
      * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark         x86-64-{baseline|v[234]} ISA level as needed.
      * Add -z unique-symbol to avoid duplicated local symbol names.
      * The creation of PE format DLLs now defaults to using a more         secure set of DLL characteristics.
      * The linker now deduplicates the types in .ctf sections.  The new          command-line option --ctf-share-types describes how to do this:
         its default value, share-unconflicted, produces the most compact          output.
      * The linker now omits the 'variable section' from .ctf sections         by default, saving space.  This is almost certainly what you         want unless you are working on a project that has its own         analogue of symbol tables that are not reflected in the ELF         symtabs.

    New features in other binary tools:

      * The ar tool's previously unused l modifier is now used for         specifying dependencies of a static library. The arguments of         this option (or --record-libdeps long form option) will be         stored verbatim in the __.LIBDEP member of the archive, which         the linker may read at link time.
      * Readelf can now display the contents of LTO symbol table         sections when asked to do so via the --lto-syms command line         option.
      * Readelf now accepts the -C command line option to enable the         demangling of symbol names.  In addition the --demangle=<style>,
        --no-demangle, --recurse-limit and --no-recurse-limit options         are also now availale.

    The following security fixes are addressed by the update:

    - CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452).
    - CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c     (bsc#1183511).
    - CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory     consumption in bfd's dwarf2.c read_section() (bsc#1184620).
    - CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794).
    - CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898).
    - CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899).
    - CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900).
    - CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901).
    - CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902).
    - CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903)
    - CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c     via crafted PEF file (bsc#1180451).
    - CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value     of bfd_malloc (bsc#1180454).
    - CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3616-1 advisory.

    Update to binutils 2.37:

    * The GNU Binutils sources now requires a C99 compiler and library to       build.
    * Support for Realm Management Extension (RME) for AArch64 has been       added.
    * A new linker option '-z report-relative-reloc' for x86 ELF targets       has been added to report dynamic relative relocations.
    * A new linker option '-z start-stop-gc' has been added to disable       special treatment of __start_*/__stop_* references when
      --gc-sections.
    * A new linker options '-Bno-symbolic' has been added which will       cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
    * The readelf tool has a new command line option which can be used to       specify how the numeric values of symbols are reported.
      --sym-base=0|8|10|16 tells readelf to display the values in base 8,       base 10 or base 16.  A sym base of 0 represents the default action       of displaying values under 10000 in base 10 and values above that in       base 16.
    * A new format has been added to the nm program.  Specifying       '--format=just-symbols' (or just using -j) will tell the program to       only display symbol names and nothing else.
    * A new command line option '--keep-section-symbols' has been added to       objcopy and strip.  This stops the removal of unused section symbols       when the file is copied.  Removing these symbols saves space, but       sometimes they are needed by other tools.
    * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options       supported by objcopy now make undefined symbols weak on targets that       support weak symbols.
    * Readelf and objdump can now display and use the contents of .debug_sup       sections.
    * Readelf and objdump will now follow links to separate debug info       files by default.  This behaviour can be stopped via the use of the       new '-wN' or '--debug-dump=no-follow-links' options for readelf and       the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also       the old behaviour can be restored by the use of the       '--enable-follow-debug-links=no' configure time option.

      The semantics of the =follow-links option have also been slightly       changed.  When enabled, the option allows for the loading of symbol       tables and string tables from the separate files which can be used       to enhance the information displayed when dumping other sections,       but it does not automatically imply that information from the       separate files should be displayed.

      If other debug section display options are also enabled (eg       '--debug-dump=info') then the contents of matching sections in both       the main file and the separate debuginfo file *will* be displayed.
      This is because in most cases the debug section will only be present       in one of the files.

      If however non-debug section display options are enabled (eg       '--sections') then the contents of matching parts of the separate       debuginfo file will *not* be displayed.  This is because in most       cases the user probably only wanted to load the symbol information       from the separate debuginfo file.  In order to change this behaviour       a new command line option --process-links can be used.  This will       allow di0pslay options to applied to both the main file and any       separate debuginfo files.

    * Nm has a new command line option: '--quiet'.  This suppresses 'no       symbols' diagnostic.

    Update to binutils 2.36:

    New features in the Assembler:

    - General:

       * When setting the link order attribute of ELF sections, it is now          possible to use a numeric section index instead of symbol name.
       * Added a .nop directive to generate a single no-op instruction in          a target neutral manner.  This instruction does have an effect on          DWARF line number generation, if that is active.
       * Removed --reduce-memory-overheads and --hash-size as gas now          uses hash tables that can be expand and shrink automatically.

    - X86/x86_64:

       * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key          Locker instructions.
       * Support non-absolute segment values for lcall and ljmp.
       * Add {disp16} pseudo prefix to x86 assembler.
       * Configure with --enable-x86-used-note by default for Linux/x86.

    -  ARM/AArch64:

       * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,          Cortex-R82, Neoverse V1, and Neoverse N2 cores.
       * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded          Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call          Stack Recorder Extension) and BRBE (Branch Record Buffer          Extension) system registers.
       * Add support for Armv8-R and Armv8.7-A ISA extensions.
       * Add support for DSB memory nXS barrier, WFET and WFIT          instruction for Armv8.7.
       * Add support for +csre feature for -march. Add CSR PDEC          instruction for CSRE feature in AArch64.
       * Add support for +flagm feature for -march in Armv8.4 AArch64.
       * Add support for +ls64 feature for -march in Armv8.7          AArch64. Add atomic 64-byte load/store instructions for this          feature.
       * Add support for +pauth (Pointer Authentication) feature for
         -march in AArch64.

    New features in the Linker:

      * Add --error-handling-script=<NAME> command line option to allow         a helper script to be invoked when an undefined symbol or a         missing library is encountered.  This option can be suppressed         via the configure time switch: --enable-error-handling-script=no.
      * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark         x86-64-{baseline|v[234]} ISA level as needed.
      * Add -z unique-symbol to avoid duplicated local symbol names.
      * The creation of PE format DLLs now defaults to using a more         secure set of DLL characteristics.
      * The linker now deduplicates the types in .ctf sections.  The new          command-line option --ctf-share-types describes how to do this:
         its default value, share-unconflicted, produces the most compact          output.
      * The linker now omits the 'variable section' from .ctf sections         by default, saving space.  This is almost certainly what you         want unless you are working on a project that has its own         analogue of symbol tables that are not reflected in the ELF         symtabs.

    New features in other binary tools:

      * The ar tool's previously unused l modifier is now used for         specifying dependencies of a static library. The arguments of         this option (or --record-libdeps long form option) will be         stored verbatim in the __.LIBDEP member of the archive, which         the linker may read at link time.
      * Readelf can now display the contents of LTO symbol table         sections when asked to do so via the --lto-syms command line         option.
      * Readelf now accepts the -C command line option to enable the         demangling of symbol names.  In addition the --demangle=<style>,
        --no-demangle, --recurse-limit and --no-recurse-limit options         are also now availale.

    The following security fixes are addressed by the update:

    - CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452).
    - CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c     (bsc#1183511).
    - CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory     consumption in bfd's dwarf2.c read_section() (bsc#1184620).
    - CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794).
    - CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898).
    - CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899).
    - CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900).
    - CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901).
    - CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902).
    - CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903)
    - CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c     via crafted PEF file (bsc#1180451).
    - CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value     of bfd_malloc (bsc#1180454).
    - CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_4364 advisory.

    * binutils: Excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c     read_section() (CVE-2021-3487)

    * binutils: Race window allows users to own arbitrary files (CVE-2021-20197)

    * binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not     validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c (CVE-2020-35448)

    * binutils: Heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (CVE-2021-20284)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gcc10-binutils installed on the remote host is prior to 2.35-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1702 advisory.

    2024-01-19: CVE-2021-20284 was added to this advisory.

    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

    A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

    A flaw was found in binutils' readelf program. An attacker who is able to convince a victim using readelf     to read a crafted file, could trigger a stack buffer overflow, out-of-bounds write of arbitrary data     supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

    There's a flaw in the BFD library of binutils. An attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of     excessive memory consumption. (CVE-2021-3487)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
157002	GLSA-202107-24 : Binutils: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	high
155427	Oracle Linux 8 : binutils (ELSA-2021-4364)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2025/9/23	medium
167457	NewStart CGSL MAIN 6.02 : binutils Multiple Vulnerabilities (NS-SA-2022-0087)	Nessus	NewStart CGSL Local Security Checks	2022/11/14	2026/1/6	high
154898	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	2021/11/5	2025/12/16	medium
154921	SUSE SLED15: binutils / binutils-devel / binutils-devel-32bit / binutils-gold / etc (SUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	2021/11/5	2026/6/25	medium
357833	Rocky Linux 8 [CIQ] Security Update: binutils / binutils-debuginfo / binutils-debugsource / etc Multiple Vulnerabilities (crlsa-2021_4364)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
153420	Amazon Linux 2 : gcc10-binutils (ALAS-2021-1702)	Nessus	Amazon Linux Local Security Checks	2021/9/16	2025/9/25	high

偵測

搜尋 Plugin

high

medium

high

medium

medium

medium

high