binutils (2.20.1-3ubuntu7.2) lucid-security; urgency=medium
* SECURITY UPDATE: integer overflow in objalloc_alloc
- debian/patches/300-CVE-2012-3509.dpatch: Add overflow check
covering alignment and CHUNK_HEADER_SIZE addition.
- CVE-2012-3509
* SECURITY UPDATE: out-of-bounds read in srec_scan of bfd/srec.c
- debian/patches/301-CVE-2014-8484.dpatch: report an error for
S-records with less than the miniumum size
- CVE-2014-8484
* SECURITY UPDATE: incorrect memory handling around corrupt group
section headers
- debian/patches/302-CVE-2014-8485.dpatch: Improve handling of
corrupt group sections
- CVE-2014-8485
* SECURITY UPDATE: out-of-bounds write in _bfd_XXi_swap_aouthdr_in
- debian/patches/303-CVE-2014-8501.dpatch: Handle corrupt binaries
with an invalid value for NumberOfRvaAndSizes.
- CVE-2014-8501
* SECURITY UPDATE: pe_print_edata buffer overflow
- debian/patches/304-CVE-2014-8502.dpatch: Detect out of
range and truncated rvas or entry counts
- CVE-2014-8502
* SECURITY UPDATE: ihex_scan buffer overflow
- debian/patches/305-CVE-2014-8503.dpatch: Fix typo in
invocation of ihex_bad_byte.
- CVE-2014-8503
* SECURITY UPDATE: srec_scan buffer overflow
- debian/patches/306-CVE-2014-8504.dpatch: Increase size of buf
- CVE-2014-8504
* SECURITY UPDATE: directory traversal vulnerabilities
- debian/patches/307-CVE-2014-8737.dpatch: disallow paths that
include ../
- CVE-2014-8737
* SECURITY UPDATE: _bfd_slurp_extended_name_table out-of-bounds write
- debian/patches/308-CVE-2014-8738.dpatch: Handle archives
with corrupt extended name tables.
- CVE-2014-8738
* SECURITY UPDATE: multiple miscellaneous overflows and out-of-bounds
reads and writes
- debian/patches/309-bz17512-misc.dpatch: fix invalid memory
accesses.
* Security hardening: don't use libbfd by default in strings(1)
- debian/patches/310-harden_strings.dpatch: Add new command
line option --data to only scan the initialized, loadable data
sections of binaries, using libbfd; make --all the default.
Date: 2015-02-09 11:05:12.793330+00:00
Changed-By: Steve Beattie <sbeat...@ubuntu.com>
Signed-By: Ubuntu Archive Robot
<cjwatson+ubuntu-archive-ro...@chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/binutils/2.20.1-3ubuntu7.2
Sorry, changesfile not available.
--
Lucid-changes mailing list
Lucid-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/lucid-changes