opensuse-su-2020:0954-1
Vulnerability from csaf_opensuse
Published
2020-07-13 14:30
Modified
2020-07-13 14:30
Summary
Security update for nasm

Notes

Title of the patch
Security update for nasm
Description of the patch
This update for nasm fixes the following issues: nasm was updated to version 2.14.02. This allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes and improvements. * Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified. * Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before). * If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7. * Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code. * Fix a corner case in the floating-point code where a binary, octal or hexadecimal floating-point having at least 32, 11, or 8 mantissa digits could produce slightly incorrect results under very specific conditions. * Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7. * Fix -E in combination with -MD. See section 2.1.21. * Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug. * Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.) * Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1. * Changed -I option semantics by adding a trailing path separator unconditionally. * Fixed null dereference in corrupted invalid single line macros. * Fixed division by zero which may happen if source code is malformed. * Fixed out of bound access in processing of malformed segment override. * Fixed out of bound access in certain EQU parsing. * Fixed buffer underflow in float parsing. * Added SGX (Intel Software Guard Extensions) instructions. * Added +n syntax for multiple contiguous registers. * Fixed subsections_via_symbols for macho object format. * Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28. * Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9. * Supported generic %pragma namespaces, output and debug. See section 6.10. * Added the --pragma command line option to inject a %pragma directive. See section 2.1.29. * Added the --before command line option to accept preprocess statement before input. See section 2.1.30. * Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions. * Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8. * Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5. * The GLOBAL directive no longer is required to precede the definition of the symbol. * Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5. * Updated UD0 encoding to match with the specification * Added the --limit-X command line option to set execution limits. See section 2.1.31. * Updated the Codeview version number to be aligned with MASM. * Added the --keep-all command line option to preserve output files. See section 2.1.32. * Added the --include command line option, an alias to -P (section 2.1.18). * Added the --help command line option as an alias to -h (section 3.1). * Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64. New upstream version 2.13.03: * Add flags: AES, VAES, VPCLMULQDQ * Add VPCLMULQDQ instruction * elf: Add missing dwarf loc section * documentation updates This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2020-954
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nasm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for nasm fixes the following issues:\n\nnasm was updated to version 2.14.02.\n\nThis allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes\nand improvements.\n\n* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.\n* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).\n* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.\n* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.\n* Fix a corner case in the floating-point code where a binary, octal or\n  hexadecimal floating-point having at least 32, 11, or 8 mantissa digits\n  could produce slightly incorrect results under very specific conditions.\n* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.\n* Fix -E in combination with -MD. See section 2.1.21.\n* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.\n* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)\n* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.\n* Changed -I option semantics by adding a trailing path separator unconditionally.\n* Fixed null dereference in corrupted invalid single line macros.\n* Fixed division by zero which may happen if source code is malformed.\n* Fixed out of bound access in processing of malformed segment override.\n* Fixed out of bound access in certain EQU parsing.\n* Fixed buffer underflow in float parsing.\n* Added SGX (Intel Software Guard Extensions) instructions.\n* Added +n syntax for multiple contiguous registers.\n* Fixed subsections_via_symbols for macho object format.\n* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.\n* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.\n* Supported generic %pragma namespaces, output and debug. See section 6.10.\n* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.\n* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.\n* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.\n* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.\n* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.\n* The GLOBAL directive no longer is required to precede the definition of the symbol.\n* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.\n* Updated UD0 encoding to match with the specification\n* Added the --limit-X command line option to set execution limits. See section 2.1.31.\n* Updated the Codeview version number to be aligned with MASM.\n* Added the --keep-all command line option to preserve output files. See section 2.1.32.\n* Added the --include command line option, an alias to -P (section 2.1.18).\n* Added the --help command line option as an alias to -h (section 3.1).\n* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.\n\nNew upstream version 2.13.03:\n\n* Add flags: AES, VAES, VPCLMULQDQ\n* Add VPCLMULQDQ instruction\n* elf: Add missing dwarf loc section\n* documentation updates\n  \nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-954",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0954-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:0954-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7JG7QO2J6GPYXBPONYRKYBTFH2XDJZJ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:0954-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7JG7QO2J6GPYXBPONYRKYBTFH2XDJZJ/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1084631",
        "url": "https://bugzilla.suse.com/1084631"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1086186",
        "url": "https://bugzilla.suse.com/1086186"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1086227",
        "url": "https://bugzilla.suse.com/1086227"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1086228",
        "url": "https://bugzilla.suse.com/1086228"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1090519",
        "url": "https://bugzilla.suse.com/1090519"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1090840",
        "url": "https://bugzilla.suse.com/1090840"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1106878",
        "url": "https://bugzilla.suse.com/1106878"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1107592",
        "url": "https://bugzilla.suse.com/1107592"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1107594",
        "url": "https://bugzilla.suse.com/1107594"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1108404",
        "url": "https://bugzilla.suse.com/1108404"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115758",
        "url": "https://bugzilla.suse.com/1115758"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115774",
        "url": "https://bugzilla.suse.com/1115774"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1115795",
        "url": "https://bugzilla.suse.com/1115795"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1173538",
        "url": "https://bugzilla.suse.com/1173538"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1000667 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1000667/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10016 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10016/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10254 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10254/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10316 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10316/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16382 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16382/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16517 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16517/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16999 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16999/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19214 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19214/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19215 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19215/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-19216 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-19216/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8881 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8881/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8882 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8882/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8883 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8883/"
      }
    ],
    "title": "Security update for nasm",
    "tracking": {
      "current_release_date": "2020-07-13T14:30:22Z",
      "generator": {
        "date": "2020-07-13T14:30:22Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:0954-1",
      "initial_release_date": "2020-07-13T14:30:22Z",
      "revision_history": [
        {
          "date": "2020-07-13T14:30:22Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nasm-2.14.02-lp152.4.3.1.i586",
                "product": {
                  "name": "nasm-2.14.02-lp152.4.3.1.i586",
                  "product_id": "nasm-2.14.02-lp152.4.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nasm-2.14.02-lp152.4.3.1.x86_64",
                "product": {
                  "name": "nasm-2.14.02-lp152.4.3.1.x86_64",
                  "product_id": "nasm-2.14.02-lp152.4.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nasm-2.14.02-lp152.4.3.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586"
        },
        "product_reference": "nasm-2.14.02-lp152.4.3.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nasm-2.14.02-lp152.4.3.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        },
        "product_reference": "nasm-2.14.02-lp152.4.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-1000667",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1000667"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file due to function assemble_file(inname, depend_ptr) at asm/nasm.c:482. vulnerability in function assemble_file(inname, depend_ptr) at asm/nasm.c:482. that can result in aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file..",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1000667",
          "url": "https://www.suse.com/security/cve/CVE-2018-1000667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1107592 for CVE-2018-1000667",
          "url": "https://bugzilla.suse.com/1107592"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-1000667"
    },
    {
      "cve": "CVE-2018-10016",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10016"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10016",
          "url": "https://www.suse.com/security/cve/CVE-2018-10016"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089084 for CVE-2018-10016",
          "url": "https://bugzilla.suse.com/1089084"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-10016"
    },
    {
      "cve": "CVE-2018-10254",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10254"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10254",
          "url": "https://www.suse.com/security/cve/CVE-2018-10254"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1090519 for CVE-2018-10254",
          "url": "https://bugzilla.suse.com/1090519"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-10254"
    },
    {
      "cve": "CVE-2018-10316",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10316"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10316",
          "url": "https://www.suse.com/security/cve/CVE-2018-10316"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1090840 for CVE-2018-10316",
          "url": "https://bugzilla.suse.com/1090840"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-10316"
    },
    {
      "cve": "CVE-2018-16382",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16382"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in x86/regflags.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16382",
          "url": "https://www.suse.com/security/cve/CVE-2018-16382"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1106878 for CVE-2018-16382",
          "url": "https://bugzilla.suse.com/1106878"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16382"
    },
    {
      "cve": "CVE-2018-16517",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16517"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16517",
          "url": "https://www.suse.com/security/cve/CVE-2018-16517"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1107594 for CVE-2018-16517",
          "url": "https://bugzilla.suse.com/1107594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-16517"
    },
    {
      "cve": "CVE-2018-16999",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16999"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16999",
          "url": "https://www.suse.com/security/cve/CVE-2018-16999"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1108404 for CVE-2018-16999",
          "url": "https://bugzilla.suse.com/1108404"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-16999"
    },
    {
      "cve": "CVE-2018-19214",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19214"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19214",
          "url": "https://www.suse.com/security/cve/CVE-2018-19214"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115795 for CVE-2018-19214",
          "url": "https://bugzilla.suse.com/1115795"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19214"
    },
    {
      "cve": "CVE-2018-19215",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19215"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19215",
          "url": "https://www.suse.com/security/cve/CVE-2018-19215"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115774 for CVE-2018-19215",
          "url": "https://bugzilla.suse.com/1115774"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-19215"
    },
    {
      "cve": "CVE-2018-19216",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-19216"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-19216",
          "url": "https://www.suse.com/security/cve/CVE-2018-19216"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115758 for CVE-2018-19216",
          "url": "https://bugzilla.suse.com/1115758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-19216"
    },
    {
      "cve": "CVE-2018-8881",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8881"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8881",
          "url": "https://www.suse.com/security/cve/CVE-2018-8881"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1086228 for CVE-2018-8881",
          "url": "https://bugzilla.suse.com/1086228"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8881"
    },
    {
      "cve": "CVE-2018-8882",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8882"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8882",
          "url": "https://www.suse.com/security/cve/CVE-2018-8882"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1086227 for CVE-2018-8882",
          "url": "https://bugzilla.suse.com/1086227"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8882"
    },
    {
      "cve": "CVE-2018-8883",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8883"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
          "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8883",
          "url": "https://www.suse.com/security/cve/CVE-2018-8883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1086186 for CVE-2018-8883",
          "url": "https://bugzilla.suse.com/1086186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.i586",
            "openSUSE Leap 15.2:nasm-2.14.02-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-07-13T14:30:22Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8883"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.