PT-2006-2886 · Gnu · Gcc

Felix-Gcc · Published 2006-04-20 · Updated 2018-10-18 · CVE-2006-1902

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GNU Compiler Collection (gcc) version 4.1

Description The issue is related to the fold binary function in fold-const.c, which improperly handles pointer overflow when folding a certain expression comparison to a corresponding offset comparison in cases other than EQ EXPR and NE EXPR. This might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers. The vendor states that the essence of the issue is not correctly interpreting an offset to a pointer as a signed value.

Recommendations For GNU Compiler Collection (gcc) version 4.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-1902

Affected Products

Gcc

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-1902 · Security Note
• http://securityfocus.com/archive/1/431184/100/0/threaded · Note
• http://securityfocus.com/archive/1/431245/100/0/threaded · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896 · Note
• http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html · Note
• http://securityfocus.com/archive/1/431319/100/0/threaded · Note
• http://securityfocus.com/archive/1/431297/100/0/threaded · Note
• http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h · Note
• http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html · Note
• http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763 · Note