Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0054.2
binutils security update
14 January 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: binutils
Publisher: Debian
Operating System: Debian GNU/Linux 7
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2014-8738 CVE-2014-8737 CVE-2014-8504
CVE-2014-8503 CVE-2014-8502 CVE-2014-8501
CVE-2014-8485 CVE-2014-8484
Original Bulletin:
http://www.debian.org/security/2014/dsa-3123
Revision History: January 14 2015: This update adds rebuilt packages for binutils-mingw-w64
January 12 2015: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3123-2 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
January 13, 2015 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : binutils-mingw-w64
CVE ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502
CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738
Debian Bug : 775165
In DSA 3123 the binutils package was updated for several security issues.
This update adds rebuilt packages for binutils-mingw-w64, so these will
take advantage of the fixes. For reference the original advisory text
follows.
Multiple security issues have been found in binutils, a toolbox for
binary file manipulation. These vulnerabilities include multiple memory
safety errors, buffer overflows, use-after-frees and other implementation
errors may lead to the execution of arbitrary code, the bypass of
security restrictions, path traversal attack or denial of service.
For the stable distribution (wheezy), these problems have been fixed in
version 2+deb7u1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your binutils-mingw-w64 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBAgAGBQJUtWghAAoJEFb2GnlAHawE2d0IAJqt0pbovGk5dCYfnnO1RYgq
16Qs8zCwRYGhgg9DhByIIbA8Fd6xsMfE6Tq1ywo0e/lFFl11b2XZD7PwTNQdGPOx
jBH/IKMBJ4R+ryVgScjyR4yXdrjMCMKrnt4roM6E7ShUHA+SDw/dw6Nwu2jQBqa9
xur3pFov9s/iAwLHI0J8ef/f1Du4va4/rlLlBzCyTR9C3PfuHY9QBCqSF3L5URoC
qEDt/U0FmPVfdPnjlskBEGuEsKWthOI7j2CKGaFqXMugWxWn18N3ngW4ycZhN/gG
uLWWbKngJUe0WGiDcuzqpyVX4Z6LIjsoMSspmWnN4MGi1XD3tUfN1gkR+bYw9d0=
=y67/
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVLXZsRLndAQH1ShLAQIaQw//YhNhGhkLs/Q0z+vgEZsklxoKM1BJOpwe
/P8kK9FPYFJGfAUU6/RLORVhfOwuLoe49UdOIEmPnDL9C8xpbNA672jugKgsh0TU
pM6CPQWvjHxviT7lviB9+byVd67drNXxVxo3bERdi2t+V1AKyR7pXt6sERXSHh4s
0kLGLHC3xkCnrFXN/jDxmMbC28PGT3VcbQ8VXhf1MJycrXRVAYivLZpYK4r8d+3d
Om+ONvff+QOL74ySVdxUEnO6e8OJe3Z1Ga1J3eWuASbl2kRoNXnaDIZDRHIVzsOt
A/tXMg+wHOAu6InG0Njgdjy7y34UUrCAqMoA3jaiXG/1Z1UucNR8r6kv4zUFRLEP
LWMRsqj+NrJpc7RSn2EeqrrMRfL/aS6DYmmAjAHsQlchc2JfEa+I4B7/kcuwWEp4
tE8hhioEgYCsIwb3IpS1vKkuzyd0wWygDIBCHTB8rf/Sbt9uJbk72fRHzTM1l4+u
k4B1E9PpmjH8AJWb/LiH6/T5JIvPwIa0zGyLCW2FAyy+MhDy/tPxcAmubtH2Svlq
n3QKz9L3l+HuqfRO8h+eacinERgkbUwlvjfcxUzCzpW/+ulWKwvrymtMls6GhL7z
TNybcX+jiViuiBcx2OiBkt77gMdt24ApqTtOWeNHJJjxeraMXWRYubjw9tkz3Jvj
L/JoafIoPrY=
=7xwG
-----END PGP SIGNATURE-----