Bugzilla – Bug 1208037
VUL-1: CVE-2023-25588: binutils: Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`
Last modified: 2023-09-27 20:31:11 UTC
CVE-2023-25588 In Binutils, the field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`. Upstream bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29677 Upstream fix: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25588 https://bugzilla.redhat.com/show_bug.cgi?id=2167505
A simple problem on a fuzzed invalid Mach-O object. We do compile that support into the SLE binutils (for no good reason), so the segfault can be demonstrated there. This will be fixed by an update to binutils 2.40 later in the year (only for SLE-12 and SLE-15. SLE-11 will remain unfixed).
This is an autogenerated message for OBS integration: This bug (1208037) was mentioned in https://build.opensuse.org/request/show/1073595 Factory / binutils
SUSE-SU-2023:3695-1: An update that solves 20 vulnerabilities, contains two features and has three security fixes can now be installed. Category: security (important) Bug References: 1200962, 1206080, 1206556, 1208037, 1208038, 1208040, 1208409, 1209642, 1210297, 1210733, 1213282, 1213458, 1214565, 1214567, 1214579, 1214580, 1214604, 1214611, 1214619, 1214620, 1214623, 1214624, 1214625 CVE References: CVE-2020-19726, CVE-2021-32256, CVE-2022-35205, CVE-2022-35206, CVE-2022-4285, CVE-2022-44840, CVE-2022-45703, CVE-2022-47673, CVE-2022-47695, CVE-2022-47696, CVE-2022-48063, CVE-2022-48064, CVE-2022-48065, CVE-2023-0687, CVE-2023-1579, CVE-2023-1972, CVE-2023-2222, CVE-2023-25585, CVE-2023-25587, CVE-2023-25588 Jira References: PED-1435, PED-5778 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): binutils-2.41-9.53.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): binutils-2.41-9.53.1 SUSE Linux Enterprise Server 12 SP5 (src): binutils-2.41-9.53.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): binutils-2.41-9.53.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3825-1: An update that solves 20 vulnerabilities, contains one feature and has two security fixes can now be installed. Category: security (important) Bug References: 1200962, 1206080, 1206556, 1208037, 1208038, 1208040, 1208409, 1209642, 1210297, 1210733, 1213458, 1214565, 1214567, 1214579, 1214580, 1214604, 1214611, 1214619, 1214620, 1214623, 1214624, 1214625 CVE References: CVE-2020-19726, CVE-2021-32256, CVE-2022-35205, CVE-2022-35206, CVE-2022-4285, CVE-2022-44840, CVE-2022-45703, CVE-2022-47673, CVE-2022-47695, CVE-2022-47696, CVE-2022-48063, CVE-2022-48064, CVE-2022-48065, CVE-2023-0687, CVE-2023-1579, CVE-2023-1972, CVE-2023-2222, CVE-2023-25585, CVE-2023-25587, CVE-2023-25588 Jira References: PED-5778 Sources used: openSUSE Leap 15.5 (src): cross-s390x-binutils-2.41-150100.7.46.1, cross-ia64-binutils-2.41-150100.7.46.1, cross-m68k-binutils-2.41-150100.7.46.1, cross-avr-binutils-2.41-150100.7.46.1, cross-hppa-binutils-2.41-150100.7.46.1, cross-sparc64-binutils-2.41-150100.7.46.1, cross-i386-binutils-2.41-150100.7.46.1, cross-xtensa-binutils-2.41-150100.7.46.1, cross-ppc-binutils-2.41-150100.7.46.1, cross-ppc64le-binutils-2.41-150100.7.46.1, cross-epiphany-binutils-2.41-150100.7.46.1, cross-riscv64-binutils-2.41-150100.7.46.1, cross-aarch64-binutils-2.41-150100.7.46.1, cross-hppa64-binutils-2.41-150100.7.46.1, cross-rx-binutils-2.41-150100.7.46.1, cross-ppc64-binutils-2.41-150100.7.46.1, cross-x86_64-binutils-2.41-150100.7.46.1, cross-spu-binutils-2.41-150100.7.46.1, cross-arm-binutils-2.41-150100.7.46.1, binutils-2.41-150100.7.46.1, cross-s390-binutils-2.41-150100.7.46.1, cross-sparc-binutils-2.41-150100.7.46.1, cross-mips-binutils-2.41-150100.7.46.1 Basesystem Module 15-SP4 (src): binutils-2.41-150100.7.46.1 Basesystem Module 15-SP5 (src): binutils-2.41-150100.7.46.1 Development Tools Module 15-SP4 (src): binutils-2.41-150100.7.46.1 Development Tools Module 15-SP5 (src): binutils-2.41-150100.7.46.1 SUSE Package Hub 15 15-SP4 (src): binutils-2.41-150100.7.46.1 SUSE Package Hub 15 15-SP5 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): binutils-2.41-150100.7.46.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): binutils-2.41-150100.7.46.1 SUSE Manager Proxy 4.2 (src): binutils-2.41-150100.7.46.1 SUSE Manager Retail Branch Server 4.2 (src): binutils-2.41-150100.7.46.1 SUSE Manager Server 4.2 (src): binutils-2.41-150100.7.46.1 SUSE Enterprise Storage 7.1 (src): binutils-2.41-150100.7.46.1 SUSE CaaS Platform 4.0 (src): binutils-2.41-150100.7.46.1 openSUSE Leap 15.4 (src): binutils-2.41-150100.7.46.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.