ALAS2023-2023-119


Amazon Linux 2023 Security Advisory: ALAS-2023-119
Advisory Release Date: 2023-03-06 17:50 Pacific
Advisory Updated Date: 2023-03-08 00:51 Pacific
Severity: Low

Issue Overview:

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. (CVE-2022-38533)


Affected Packages:

binutils


Issue Correction:
Run dnf update binutils --releasever=2023.0.20230308 to update your system.

New Packages:
aarch64:
    binutils-devel-2.39-6.amzn2023.0.5.aarch64
    binutils-gprofng-debuginfo-2.39-6.amzn2023.0.5.aarch64
    binutils-debuginfo-2.39-6.amzn2023.0.5.aarch64
    binutils-gprofng-2.39-6.amzn2023.0.5.aarch64
    binutils-2.39-6.amzn2023.0.5.aarch64
    binutils-debugsource-2.39-6.amzn2023.0.5.aarch64

src:
    binutils-2.39-6.amzn2023.0.5.src

x86_64:
    binutils-devel-2.39-6.amzn2023.0.5.x86_64
    binutils-gprofng-debuginfo-2.39-6.amzn2023.0.5.x86_64
    binutils-debuginfo-2.39-6.amzn2023.0.5.x86_64
    binutils-gprofng-2.39-6.amzn2023.0.5.x86_64
    binutils-2.39-6.amzn2023.0.5.x86_64
    binutils-debugsource-2.39-6.amzn2023.0.5.x86_64