CVE-2023-4039

CVE-2023-4039 describes a GCC stack-protector issue on AArch64: failure of -fstack-protector to detect buffer overflows in C99-style dynamically-sized locals/alloca, unlike static locals. The default overflow handling would terminate the process, but an attacker might influence control flow if an...

CVE-2018-12886

CVE-2018-12886: In GCC 4.1–8, on ARM targets, stack_protect_prologue/epilogue may spill the stack-protector guard address, enabling an attacker to bypass -fstack-protector families by controlling what the canary is compared against. Impact is stack overflow protection bypass; no exploitation deta...

CVE-2019-15847

CVE-2019-15847 affects the POWER9 backend of GCC, where the compiler could coalesce multiple __builtin_darn() calls into one due to an unspecified volatile operation, reducing random-number entropy. The GCC GLSA/Advisory notes that this issue stems from flawed code generation and can cause repeat...

CVE-2022-27943

CVE-2022-27943 is a stack consumption (stack exhaustion) vulnerability in libiberty/rust-demangle.c (Rust demangler) within GNU GCC 11.2, demonstrated by nm-new. Affected component: libiberty/rust-demangle.c; root cause: stack depth growth during demangling leading to exhaustion. Impact per docum...

CVE-2017-11671

CVE-2017-11671 affects GCC: the ix86_expand_builtin path in i386.c can generate RDRAND/RDSEED instruction sequences that clobber the status flag before being read, potentially causing reduced randomness. Documented in GCC bug reports and affected across GCC 4.6–4.9, 5 before 5.5, and 6 before 6.4...

CVE-2021-3826

CVE-2021-3826 is a heap/stack buffer overflow in libiberty’s dlang_lname function (d-demangle.c). A crafted mangled symbol can trigger a segmentation fault and crash, causing a denial of service. The issue is associated with GCC/binutils’ libiberty/demangling code and has been addressed in vendor...

CVE-2021-46195

CVE-2021-46195 affects GCC v12.0, specifically the libiberty/rust-demangle.c component. The issue is an uncontrolled recursion that allows a DoS by consuming CPU and memory. The provided connected Nessus entry for MiracleLinux 9 notes a linked advisory tying GCC 12.0.1-11.2.el9 to this CVE, confi...

CVE-2021-37322

CVE-2021-37322 affects GCC c++filt v2.26; the vulnerability is a use-after-free in the cplus-dem.c component. Impact is described by CVSSv3 as High (local access, user interaction not required). Public remediation details are not provided in the supplied documents.

CVE-2002-2439

CVE-2002-2439 describes an integer overflow in the C++ operator new[] in the GNU GCC compiler before 4.8.0, potentially allowing unspecified impacts. Affected software: GCC versions prior to 4.8.0. Root cause: integer overflow while calculating allocation size for new[] allocations. Impact as sta...

CVE-2008-1367

CVE-2008-1367 corresponds to a Linux kernel issue where gcc 4.3.x may not emit a cld instruction while compiling string manipulation code (e.g., memcpy/memmove), preventing the direction flag (DF) from being reset and potentially causing memory copy in the wrong direction during signal handling. ...

CVE-2015-5276

CVE-2015-5276 : The std::random_device class in libstdc++ (GCC) before 4.9.4 does not properly handle short reads from blocking sources, which could allow context-dependent attackers to predict random values via unspecified vectors. Affected: GCC/libstdc++ prior to 4.9.4. Root cause: inadequate h...

CVE-2006-1902

CVE-2006-1902 affects GNU Compiler Collection (gcc) 4.1. The issue, described consistently across connected sources, is in fold_binary inside fold-const.c where pointer overflow occurs when folding a specific expression comparison to a corresponding offset comparison (excluding EQ_EXPR/NE_EXPR). ...

CVE-2000-1219

The CVE-2000-1219 entry documents a flaw in the -ftrapv option of gcc/g++ 3.3.3 and earlier that fails to handle all integer overflow types, potentially leaving applications vulnerable to overflow-related issues. Connected records confirm the affected component and root cause (incomplete handling...

CVE-2008-1685

CVE-2008-1685 affects GNU Compiler Collection versions 4.2.0–4.3.0. The issue is that when casts are not used, the sum of a pointer and an int may be considered >= the pointer, which can lead to removal of length-testing code intended as protection against integer overflow and buffer overflow,...