GNU Gcc vulnerabilities

14 CVEs affecting GNU Gcc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4039, published 2023-09-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-15847, published 2019-09-02. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number…
CVE-2015-5276, published 2015-11-17. Medium severity, CVSS 5.0. EPSS: 2.9% chance of exploitation in the next 30 days. The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent…
CVE-2008-1367, published 2008-03-17. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being…
CVE-2018-12886, published 2019-05-22. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when…
CVE-2021-3826, published 2022-09-01. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled…
CVE-2000-1219, published 2000-11-01. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to vulnerabilities related to overflows.
CVE-2008-1685, published 2008-04-06. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of…
CVE-2023-4039, published 2023-09-13. Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days. **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in…
CVE-2022-27943, published 2022-03-26. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
CVE-2021-37322, published 2021-11-18. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

Latest

CVE-2021-46195, published 2022-01-14. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming…
CVE-2002-2439, published 2019-10-23. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
CVE-2017-11671, published 2017-07-26. Medium severity, CVSS 4.0. EPSS: 0.5% chance of exploitation in the next 30 days. Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences…