QID 751321

Date Published: 2021-11-10

QID 751321: SUSE Enterprise Linux Security Update for binutils (SUSE-SU-2021:3616-1)

This update for binutils fixes the following issues: update to binutils 2.37: * the gnu binutils sources now requires a c99 compiler and library to build.
* support for realm management extension (rme) for aarch64 has been added.
* a new linker option -z report-relative-reloc for x86 elf targets has been added to report dynamic relative relocations.
* a new linker option -z start-stop-gc has been added to disable special treatment of __start_*/__stop_* references when --gc-sections.
* a new linker options -bno-symbolic has been added which will cancel the -bsymbolic and -bsymbolic-functions options.
* the readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported.
--sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16.
a sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.
* a new format has been added to the nm program.
specifying --format=just-symbols (or just using -j) will tell the program to only display symbol names and nothing else.
* a new command line option --keep-section-symbols has been added to objcopy and strip.
this stops the removal of unused section symbols when the file is copied.
removing these symbols saves space, but sometimes they are needed by other tools.
* the --weaken, --weaken-symbol and --weaken-symbols options supported by objcopy now make undefined symbols weak on targets that support weak symbols.
* readelf and objdump can now display and use the contents of .debug_sup sections.
* readelf and objdump will now follow links to separate debug info files by default.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation allows attacker to compromise the system.

  • CVSS V3 rated as High - 6.5 severity.
  • CVSS V2 rated as Medium - 4.3 severity.
  • Solution
    Upgrade to the latest package which contains the patch. To install this SUSE Security, Update use YaST online_update. Alternatively you can run the command listed for your product. To install packages using the command line interface, use command "yum update". Refer to Suse security advisory: SUSE-SU-2021:3616-1 to address this issue and obtain further details.
    Software Advisories
    Advisory ID Software Component Link
    SUSE-SU-2021:3616-1 SUSE Enterprise Linux URL Logo lists.suse.com/pipermail/sle-security-updates/2021-November/009696.html