NS-SA-2024-0013

简介

important: apr-util/binutils security update

严重级别

important

主题

An update for apr-util/binutils is now available for NewStart CGSL MAIN 5.04/CGSL CORE 5.04.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

apr-util:
binutils:


Security Fix(es):
apr-util: A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.(CVE-2022-25147)
apr-util: bugfix
binutils: A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceive a human reviewer by creating a malicious patch containing well placed BiDi characters. The special handling and rendering of those characters can be then used in an attempt to hide unexpected and potentially dangerous behaviour from the reviewer.(CVE-2021-42574)
binutils: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 5.04.F54B2.

影响组件

• apr-util
• binutils

影响产品

• CGSL MAIN 5.04
• CGSL CORE 5.04

更新包

CVE

• CVE-2022-25147
• CVE-2021-42574

参考

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-25147
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42574