Integer overflow, leading to heap-buffer overflow by processing certain file headers via bfd binary. (CVE-2012-3509)
A nonfree package is also now available, which provides components that cannot be included in the core repository.
In addition, this update obsoletes sdcc2.9, which is old and probably has the same security vulnerability.