Security update for gdb SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2916-1 Final 1 1 2019-11-07T10:36:46Z current 2019-11-07T10:36:46Z 2019-11-07T10:36:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gdb This update for gdb fixes the following issues: Update to gdb 8.3.1: (jsc#ECO-368) Security issues fixed: - CVE-2019-1010180: Fixed a potential buffer overflow when loading ELF sections larger than the file. (bsc#1142772) Upgrade libipt from v2.0 to v2.0.1. - Enable librpm for version > librpm.so.3 [bsc#1145692]: * Allow any librpm.so.x * Add %build test to check for 'zypper install <rpm-packagename>' message - Copy gdbinit from fedora master @ 25caf28. Add gdbinit.without-python, and use it for --without=python. Rebase to 8.3 release (as in fedora 30 @ 1e222a3). * DWARF index cache: GDB can now automatically save indices of DWARF symbols on disk to speed up further loading of the same binaries. * Ada task switching is now supported on aarch64-elf targets when debugging a program using the Ravenscar Profile. * Terminal styling is now available for the CLI and the TUI. * Removed support for old demangling styles arm, edg, gnu, hp and lucid. * Support for new native configuration RISC-V GNU/Linux (riscv*-*-linux*). - Implemented access to more POWER8 registers. [fate#326120, fate#325178] - Also handle most new s390 arch13 instructions. [fate#327369, jsc#ECO-368] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-2916,SUSE-2019-2916,SUSE-OpenStack-Cloud-8-2019-2916,SUSE-OpenStack-Cloud-Crowbar-8-2019-2916,SUSE-SLE-DESKTOP-12-SP4-2019-2916,SUSE-SLE-SAP-12-SP3-2019-2916,SUSE-SLE-SDK-12-SP4-2019-2916,SUSE-SLE-SDK-12-SP5-2019-2916,SUSE-SLE-SERVER-12-SP3-2019-2916,SUSE-SLE-SERVER-12-SP3-BCL-2019-2916,SUSE-SLE-SERVER-12-SP4-2019-2916,SUSE-SLE-SERVER-12-SP5-2019-2916,SUSE-Storage-5-2019-2916 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192916-1/ Link for SUSE-SU-2019:2916-1 https://lists.suse.com/pipermail/sle-security-updates/2019-November/006098.html E-Mail link for SUSE-SU-2019:2916-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1115034 SUSE Bug 1115034 https://bugzilla.suse.com/1142772 SUSE Bug 1142772 https://bugzilla.suse.com/1145692 SUSE Bug 1145692 https://www.suse.com/security/cve/CVE-2019-1010180/ SUSE CVE CVE-2019-1010180 page https://bugzilla.suse.com/ECO-368 SUSE Bug ECO-368 HPE Helion OpenStack 8 SUSE Enterprise Storage 5 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 gdb-8.3.1-2.14.1 gdb-32bit-8.3.1-2.14.1 gdb-64bit-8.3.1-2.14.1 gdb-testresults-8.3.1-2.14.1 gdbserver-8.3.1-2.14.1 gdbserver-32bit-8.3.1-2.14.1 gdbserver-64bit-8.3.1-2.14.1 gdb-8.3.1-2.14.1 as a component of HPE Helion OpenStack 8 gdb-8.3.1-2.14.1 as a component of SUSE Enterprise Storage 5 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server 12 SP4 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server 12 SP5 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 gdb-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 gdbserver-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 gdbserver-32bit-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 gdbserver-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 gdbserver-32bit-8.3.1-2.14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 gdb-8.3.1-2.14.1 as a component of SUSE OpenStack Cloud 8 gdb-8.3.1-2.14.1 as a component of SUSE OpenStack Cloud Crowbar 8 GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet. CVE-2019-1010180 HPE Helion OpenStack 8:gdb-8.3.1-2.14.1 SUSE Enterprise Storage 5:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Desktop 12 SP4:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server 12 SP3-BCL:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server 12 SP3-LTSS:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server 12 SP4:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server 12 SP5:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:gdb-8.3.1-2.14.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gdbserver-32bit-8.3.1-2.14.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gdbserver-8.3.1-2.14.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gdbserver-32bit-8.3.1-2.14.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gdbserver-8.3.1-2.14.1 SUSE OpenStack Cloud 8:gdb-8.3.1-2.14.1 SUSE OpenStack Cloud Crowbar 8:gdb-8.3.1-2.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192916-1/ https://www.suse.com/security/cve/CVE-2019-1010180.html CVE-2019-1010180 https://bugzilla.suse.com/1142772 SUSE Bug 1142772