USN-5341-1: GNU binutils vulnerabilities
22 March 2022
Several security issues were fixed in GNU binutils.
Releases
Packages
- binutils - GNU assembler, linker and binary utilities
Details
It was discovered that GNU binutils incorrectly handled checks for memory
allocation when parsing relocs in a corrupt file. An attacker could possibly
use this issue to cause a denial of service. (CVE-2017-17122)
It was discovered that GNU binutils incorrectly handled certain corrupt DWARF
debug sections. An attacker could possibly use this issue to cause GNU
binutils to consume memory, resulting in a denial of service. (CVE-2021-3487)
It was discovered that GNU binutils incorrectly performed bounds checking
operations when parsing stabs debugging information. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2021-45078)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
binutils-multiarch
-
2.26.1-1ubuntu1~16.04.8+esm3
Available with Ubuntu Pro
-
binutils
-
2.26.1-1ubuntu1~16.04.8+esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.