Date: Wed, 18 Aug 2021 06:16:43 GMT From: =?utf-8?Q?Fernando Apestegu=C3=ADa?= <fernape@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 2a99b5e68473 - main - security/vuxml: Excessive memory consumption vulnerability in binutils Message-ID: <202108180616.17I6Gh66097095@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=2a99b5e684733568e6e532c434c0b43767168d3e commit 2a99b5e684733568e6e532c434c0b43767168d3e Author: Yasuhiro Kimura <yasu@utahime.org> AuthorDate: 2021-08-18 06:05:28 +0000 Commit: Fernando Apesteguía <fernape@FreeBSD.org> CommitDate: 2021-08-18 06:10:16 +0000 security/vuxml: Excessive memory consumption vulnerability in binutils Fixed in main a0e752df8013 and in 2021Q3 in 9c4ee12. PR: 256133 Reviewed by: fluffy@, koobs@ Security: CVE-2021-3487 --- security/vuxml/vuln-2021.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 2e4e71dee8b8..bb82132255ae 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,34 @@ + <vuln vid="f4c54b81-bcc8-11eb-a7a6-080027f515ea"> + <topic>binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()</topic> + <affects> + <package> + <name>binutils</name> + <range><lt>2.33.1_5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Hao Wang reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3487">; + <p> + There's a flaw in the BFD library of binutils in versions before 2.36. + An attacker who supplies a crafted file to an application linked with BFD, + and using the DWARF functionality, could cause an impact to system + availability by way of excessive memory consumption. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2021-3487</cvename> + <url>https://sourceware.org/bugzilla/show_bug.cgi?id=26946</url>; + </references> + <dates> + <discovery>2020-11-25</discovery> + <entry>2021-08-13</entry> + </dates> + </vuln> + <vuln vid="128deba6-ff56-11eb-8514-3065ec8fd3ec"> <topic>chromium -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108180616.17I6Gh66097095>