[Bug 1162594] New: CVE-2014-8502 binutils: heap overflow in objdump

List overview All Threads
Download

newer

older

[Bug 1162607] New: CVE-2014-8503...

[Bug 1162570] New: CVE-2014-8501...

Red Hat Bugzilla

11 Nov 2014 11 Nov '14

11:20 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Bug ID: 1162594 Summary: CVE-2014-8502 binutils: heap overflow in objdump Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: bgollahe@redhat.com, dan@danny.cz, dhowells@redhat.com, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, jakub@redhat.com, kalevlember@gmail.com, kanderso@redhat.com, ktietz@redhat.com, law@redhat.com, lkocman@redhat.com, lkundrak@v3.sk, mfranc@redhat.com, mhlavink@redhat.com, nickc@redhat.com, ohudlick@redhat.com, pfrankli@redhat.com, rjones@redhat.com, rob@robspanton.com, seceng-idm-qe-list@redhat.com, swhiteho@redhat.com, thibault.north@gmail.com, tmlcoch@redhat.com, trond.danielsen@gmail.com

A heap overflow was reborted [1] when running objdump on a specially crafted PE executable [2]. Upstream patches that address this are at [3] and [4].

[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17512#c17 [2]: https://sourceware.org/bugzilla/attachment.cgi?id=7862 [3]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5a4b0ccc20ba30cae... [4]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=acafeb6056bec47d7...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pnYCBTnBr5&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

11 Nov 11 Nov

11:20 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1156276

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZUS5bvFLmm&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created mingw-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162602] Affects: epel-all [bug 1162606]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1162598 [Bug 1162598] CVE-2014-8502 arm-none-eabi-binutils-cs: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162599 [Bug 1162599] CVE-2014-8502 avr-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162600 [Bug 1162600] CVE-2014-8502 binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162601 [Bug 1162601] CVE-2014-8502 cross-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162602 [Bug 1162602] CVE-2014-8502 mingw-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162603 [Bug 1162603] CVE-2014-8502 msp430-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162604 [Bug 1162604] CVE-2014-8502 avr-binutils: binutils: heap overflow in objdump [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162605 [Bug 1162605] CVE-2014-8502 cross-binutils: binutils: heap overflow in objdump [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162606 [Bug 1162606] CVE-2014-8502 mingw-binutils: binutils: heap overflow in objdump [epel-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zAa8Axdodv&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created avr-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162599] Affects: epel-all [bug 1162604]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=8hdd2SyNiW&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #3 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created arm-none-eabi-binutils-cs tracking bugs for this issue:

Affects: fedora-all [bug 1162598]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HgeBPNr62V&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #4 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created msp430-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162603]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cp06eEGnDB&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #5 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created cross-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162601] Affects: epel-all [bug 1162605]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kC7br14hDB&a=cc_unsubscribe

Red Hat Bugzilla

11:25 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #6 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1162600]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=xYWP5nDoIH&a=cc_unsubscribe

Red Hat Bugzilla

26 Nov 26 Nov

2:50 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zOGmxxwhRP&a=cc_unsubscribe

Red Hat Bugzilla

2:52 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Comment #9 from Vasyl Kaigorodov vkaigoro@redhat.com --- Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5VqqvlM3WJ&a=cc_unsubscribe

Red Hat Bugzilla

3:13 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |binutils 2.25

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6s2BIL2dLd&a=cc_unsubscribe

Red Hat Bugzilla

3:53 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168281

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=na9m4KMMam&a=cc_unsubscribe

Red Hat Bugzilla

3:53 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168302

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=hEoVYVYDhm&a=cc_unsubscribe

Red Hat Bugzilla

27 Nov 27 Nov

9:13 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5JSohtt5pY&a=cc_unsubscribe

Red Hat Bugzilla

2:38 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iHO9mTcvSm&a=cc_unsubscribe

Red Hat Bugzilla

6 Dec 6 Dec

2:36 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162598, which changed state.

Bug 1162598 Summary: CVE-2014-8502 arm-none-eabi-binutils-cs: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162598

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=uhzZAnHtvs&a=cc_unsubscribe

Red Hat Bugzilla

2:36 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #11 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=MTPJ0JSXmZ&a=cc_unsubscribe

Red Hat Bugzilla

2:39 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162599, which changed state.

Bug 1162599 Summary: CVE-2014-8502 avr-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162599

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nHJAZvmyeN&a=cc_unsubscribe

Red Hat Bugzilla

2:40 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #12 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=WnRkeIxEEs&a=cc_unsubscribe

Red Hat Bugzilla

10:04 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #13 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Npi30N7UQI&a=cc_unsubscribe

Red Hat Bugzilla

10:08 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #14 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Wgelsuffiq&a=cc_unsubscribe

Red Hat Bugzilla

7 Dec 7 Dec

4:37 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #15 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=yG2tklUYag&a=cc_unsubscribe

Red Hat Bugzilla

4:39 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #16 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GmTNrscQ2B&a=cc_unsubscribe

Red Hat Bugzilla

10 Dec 10 Dec

3:28 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1172710

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DC6oFyf6jI&a=cc_unsubscribe

Red Hat Bugzilla

2 Jan 2 Jan

5:05 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162602, which changed state.

Bug 1162602 Summary: CVE-2014-8502 mingw-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162602

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=npe07Coxpj&a=cc_unsubscribe

Red Hat Bugzilla

9 Jan 9 Jan

3 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162606, which changed state.

Bug 1162606 Summary: CVE-2014-8502 mingw-binutils: binutils: heap overflow in objdump [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162606

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VlT2r5qY9b&a=cc_unsubscribe

Red Hat Bugzilla

24 Mar 24 Mar

6:52 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162601, which changed state.

Bug 1162601 Summary: CVE-2014-8502 cross-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162601

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=T0PhUCwMmB&a=cc_unsubscribe

Red Hat Bugzilla

13 May 13 May

11:21 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DYSn8FGQLV&a=cc_unsubscribe

Red Hat Bugzilla

18 May 18 May

12:11 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Doc Text *updated* --- A heap-based buffer overflow flaw was found in the way objdump utility processed certain files. If a user were tricked into running objdump on a specially crafted file, it could cause objdump to crash or potentially execute arbitrary code with the privileges of the user running an executable. The original fix for CVE-2014-8485 was found to be incomplete.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=A1eP1O6tji&a=cc_unsubscribe

Red Hat Bugzilla

26 May 26 May

10:07 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- It was found that the fix for the CVE-2014-8485 issue was incomplete: a heap-based buffer overflow in the objdump utility could cause it to crash or, potentially, execute arbitrary code with the privileges of the user running objdump when processing specially crafted files.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0TGaLLclgL&a=cc_unsubscribe

Red Hat Bugzilla

26 Jun 26 Jun

4:29 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #19 from Nick Clifton nickc@redhat.com --- Created attachment 1043575 --> https://bugzilla.redhat.com/attachment.cgi?id=1043575&action=edit Amalgamted patch to fix all of the bugs referenced by PR 1712#c17

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=jmdZBb6cBK&a=cc_unsubscribe

Red Hat Bugzilla

4:31 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #20 from Nick Clifton nickc@redhat.com --- Created attachment 1043578 --> https://bugzilla.redhat.com/attachment.cgi?id=1043578&action=edit Corrupt binary that (used to) crash objdump -x

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gzSd0iLbz3&a=cc_unsubscribe

Red Hat Bugzilla

4:32 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #21 from Nick Clifton nickc@redhat.com --- Created attachment 1043579 --> https://bugzilla.redhat.com/attachment.cgi?id=1043579&action=edit Second corrupt binary that (used to ) crash objdump -x

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=jTNGRwHMfq&a=cc_unsubscribe

Red Hat Bugzilla

4:33 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #22 from Nick Clifton nickc@redhat.com --- Created attachment 1043580 --> https://bugzilla.redhat.com/attachment.cgi?id=1043580&action=edit Corrupt ELF binary that (used to) crash objdump -x

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gsJ4pi4fvs&a=cc_unsubscribe

Red Hat Bugzilla

4:36 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #23 from Nick Clifton nickc@redhat.com --- I have uploaded a patch to fix this BZ, plus the three corrupt binary files (extracted from PR 17512) that used to trigger the bugs.

I am not sure what I should do next. Can someone please advise ?

Cheers Nick

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mItrc57LMr&a=cc_unsubscribe

Red Hat Bugzilla

4:45 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #24 from Jeff Law law@redhat.com --- Nick, I'll walk you through the various process/procedural stuff Monday. Well, I'll probably send you a howto over the weekend, which you can try Monday morning and if there's questions, we can cover them in IRC Monday.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=O0QJ1wahXt&a=cc_unsubscribe

Red Hat Bugzilla

29 Jun 29 Jun

1:44 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Nick Clifton nickc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NEnbZj2zUF&a=cc_unsubscribe

Red Hat Bugzilla

30 Jun 30 Jun

12:15 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162600, which changed state.

Bug 1162600 Summary: CVE-2014-8502 binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162600

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GHOnHSS3iE&a=cc_unsubscribe

Red Hat Bugzilla

12:15 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594 Bug 1162594 depends on bug 1162603, which changed state.

Bug 1162603 Summary: CVE-2014-8502 msp430-binutils: binutils: heap overflow in objdump [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162603

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CQPGLFh56W&a=cc_unsubscribe

Red Hat Bugzilla

2 Jul 2 Jul

11:53 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QW8D2pmWmL&a=cc_unsubscribe

Red Hat Bugzilla

6 Aug 6 Aug

12:06 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Miloš Prchlík mprchlik@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |mprchlik@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7xMbJP4pTq&a=cc_unsubscribe

Red Hat Bugzilla

30 Sep 30 Sep

7:15 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1210268

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gcDm4g5tm8&a=cc_unsubscribe

Red Hat Bugzilla

7:22 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=a9QyY4YoQr&a=cc_unsubscribe

Red Hat Bugzilla

1 Oct 1 Oct

2:50 p.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Sqjk2DjqOa&a=cc_unsubscribe

Red Hat Bugzilla

19 Nov 19 Nov

3:33 a.m.

New subject: [Bug 1162594] CVE-2014-8502 binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

https://bugzilla.redhat.com/show_bug.cgi?id=1162594

--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2015:2079 https://rhn.redhat.com/errata/RHSA-2015-2079.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=2EOjj2erAz&a=cc_unsubscribe

3226

Age (days ago)

3599

Last active (days ago)

mingw@lists.fedoraproject.org

44 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla