ALAS-2015-620

References: CVE-2014-8484  CVE-2014-8485  CVE-2014-8501  CVE-2014-8502  CVE-2014-8503  CVE-2014-8504  CVE-2014-8737  CVE-2014-8738 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A directory traversal flaw was found in the strip and objcopy utilities. A specially crafted file could cause strip or objdump to overwrite an arbitrary file writable by the user running either of these utilities.

A buffer overflow flaw was found in the way various binutils utilities processed certain files. If a user were tricked into processing a specially crafted file, it could cause the utility used to process that file to crash or, potentially, execute arbitrary code with the privileges of the user running that utility.

An integer overflow flaw was found in the way the strings utility processed certain files. If a user were tricked into running the strings utility on a specially crafted file, it could cause the strings executable to crash.

A stack-based buffer overflow flaw was found in the SREC parser of the libbfd library. A specially crafted file could cause an application using the libbfd library to crash or, potentially, execute arbitrary code with the privileges of the user running that application.

A heap-based buffer overflow flaw was found in the way certain binutils utilities processed archive files. If a user were tricked into processing a specially crafted archive file, it could cause the utility used to process that archive to crash or, potentially, execute arbitrary code with the privileges of the user running that utility.

A stack-based buffer overflow flaw was found in the way various binutils utilities processed certain files. If a user were tricked into processing a specially crafted file, it could cause the utility used to process that file to crash or, potentially, execute arbitrary code with the privileges of the user running that utility.

A stack-based buffer overflow flaw was found in the way objdump processed IHEX files. A specially crafted IHEX file could cause objdump to crash or, potentially, execute arbitrary code with the privileges of the user running objdump.

It was found that the fix for the CVE-2014-8485 issue was incomplete: a heap-based buffer overflow in the objdump utility could cause it to crash or, potentially, execute arbitrary code with the privileges of the user running objdump when processing specially crafted files.

Issue Correction:
Run yum update binutils to update your system.

New Packages:

i686:
    binutils-devel-2.23.52.0.1-55.65.amzn1.i686
    binutils-debuginfo-2.23.52.0.1-55.65.amzn1.i686
    binutils-2.23.52.0.1-55.65.amzn1.i686

src:
    binutils-2.23.52.0.1-55.65.amzn1.src

x86_64:
    binutils-debuginfo-2.23.52.0.1-55.65.amzn1.x86_64
    binutils-devel-2.23.52.0.1-55.65.amzn1.x86_64
    binutils-2.23.52.0.1-55.65.amzn1.x86_64