CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-4039 – GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64
https://notcve.org/view.php?id=CVE-2023-4039
13 Sep 2023 — **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is... • https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 • CWE-693: Protection Mechanism Failure •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-37322
https://notcve.org/view.php?id=CVE-2021-37322
18 Nov 2021 — GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. Se ha detectado que GCC c++filt versión v2.26 contiene una vulnerabilidad de uso de memoria previamente liberada por medio del componente cplus-dem.c. • https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99188 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2002-2439
https://notcve.org/view.php?id=CVE-2002-2439
23 Oct 2019 — Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts. Un desbordamiento de enteros en el operador new[] en gcc versiones anteriores a 4.8.0, permite a atacantes tener impactos no especificados. • https://access.redhat.com/security/cve/cve-2002-2439 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15847 – gcc: POWER9 "DARN" RNG intrinsic produces repeated output
https://notcve.org/view.php?id=CVE-2019-15847
02 Sep 2019 — The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same. El backend POWER9 en GNU Compiler Collection (GCC) en versiones anteriores a la 10 podría optimizar múltiples llamadas de __buil... • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html • CWE-331: Insufficient Entropy •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5276
https://notcve.org/view.php?id=CVE-2015-5276
17 Nov 2015 — The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors. La clase std::random_device en libstdc++ en el GNU Compiler Collection (también conocido como GCC) en versiones anteriores a 4.9.4 no maneja adecuadamente lecturas cortas desde fuentes bloqueadas, lo que hace mas fácil para atacantes dependientes d... • http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2000-1219
https://notcve.org/view.php?id=CVE-2000-1219
01 Nov 2000 — The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to vulnerabilities related to overflows. • http://gcc.gnu.org/ml/gcc-bugs/2002-05/msg00198.html •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-1999-1439
https://notcve.org/view.php?id=CVE-1999-1439
02 Jan 1998 — gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files. • http://marc.info/?l=bugtraq&m=88419592307388&w=2 •