Advisory ROSA-SA-2021-1838

Software: gcc 4.8.5
OS: Cobalt 7.9

CVE-ID: CVE-2018-12886
CVE-Crit: HIGH
CVE-DESC: stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate sequences of instructions when targeting ARM targets that pass the address of the stack protection, allowing an attacker to bypass the -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit stack overflow protection by controlling what the stack canary is compared to.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-15847
CVE-Crit: HIGH
CVE-DESC: The POWER9 backend in the GNU Compiler Collection (GCC) prior to version 10 could optimize multiple calls to the __builtin_darn built-in function into a single call, thereby reducing the entropy of the random number generator. This occurred because an unstable operation was not specified. For example, within a single program execution, the result of each __builtin_darn () call could be the same.
CVE-STATUS: default
CVE-REV: default