FreeBSD-SA-23:14.smccc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:14.smccc Security Advisory The FreeBSD Project Topic: arm64 boot CPUs may lack speculative execution protections Category: core Module: arm64 Announced:...

Fedora 37 : traceroute (2023-734aa51998)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-734aa51998 advisory. Update to 2.1.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CBL Mariner 2.0 Security Update: gcc (CVE-2023-4039)

The version of gcc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-4039 advisory. - DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke...

Important: python38

Issue Overview: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service...

SUSE SLED15: cpp7 / cross-nvptx-gcc7 / cross-nvptx-newlib7-devel / gcc7 / etc (SUSE-SU-2023:3686-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3686-1 advisory. Security issue fixed: - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 bsc1214052. Other fixes:...

SUSE-SU-2023:3686-1 Security update for gcc7

This update for gcc7 fixes the following issues: Security issue fixed: - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 bsc1214052. Other fixes: - Fixed KASAN kernel compile. bsc1205145 - Fixed ICE with C++17 code as reported in bsc1204505 - Fixed altivec.h redefining bool...

SUSE SLES12: cpp12 / cross-nvptx-gcc12 / cross-nvptx-newlib12-devel / gcc12 / etc (SUSE-SU-2023:3640-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3640-1 advisory. - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 bsc1214052. Tenable has extracted the preceding description block...

thunderbird security update

102.15.1-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.15.1-1 - Update to 102.15.1...

SUSE: Security Advisory (SUSE-SU-2023:3640-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:3661-1 Security update for gcc12

This update for gcc12 fixes the following issues: - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 bsc1214052...

SUSE-SU-2023:3640-1 Security update for gcc12

This update for gcc12 fixes the following issues: - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 bsc1214052...

AZL-28769 CVE-2023-4039 affecting package gcc for versions less than 11.2.0-6

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

ALPINE-CVE-2023-4039

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

Design/Logic Flaw

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-4039 GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-4039

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-4039

CVE-2023-4039 describes a GCC stack-protector issue on AArch64: failure of -fstack-protector to detect buffer overflows in C99-style dynamically-sized locals/alloca, unlike static locals. The default overflow handling would terminate the process, but an attacker might influence control flow if an...

CVE-2023-4039

A vulnerability was found in GCC. The GCC's stack protection feature, enabled with the flag -fstack-protector, aims to detect buffer overflows in C/C++ function local variables that might allow an attacker to overwrite saved registers on the stack. If an attacker can modify saved register values,...

Amazon Linux 2023 : cpp, gcc, gcc-c++ (ALAS2023-2023-342)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-342 advisory. An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature -fstack-protector did not detect or defend against overflows of dynamically-sized...

Amazon Linux 2 : gcc (ALAS-2023-2245)

The version of gcc installed on the remote host is prior to 7.3.1-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2245 advisory. 2023-09-13: The severity of this advisory was corrected from low to medium. An issue was found in a defense in depth feature of the GC...