PT-2019-6470 · Gnu+1 · Gcc+1

Published 2014-03-15 · Updated 2019-10-31 · CVE-2002-2439

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gcc versions prior to 4.8.0

Description The issue is related to an integer overflow in the new[] operator, which can lead to heap overflows and security bugs. When a new array is allocated, the C++ run-time calculates its size, but if the product exceeds the maximum value that can be stored in a machine register, the error is ignored, and the truncated value is used for the heap allocation.

Recommendations For gcc versions prior to 4.8.0, update to version 4.8.0 or later to resolve the issue. As a temporary workaround, consider implementing additional checks to prevent integer overflows when using the new[] operator. Restrict access to sensitive data and functions that utilize the new[] operator to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2014-1297

CVE-2002-2439

Affected Products

Alt Linux

Gcc

References · 12

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2002-2439 · Exploit
• 🔥 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19351 · Exploit
• https://ubuntu.com/security/CVE-2002-2439 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2002-2439 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1297 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2002-2439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-2439 · Security Note
• https://cve.org/CVERecord?id=CVE-2002-2439 · Security Note
• https://access.redhat.com/security/cve/cve-2002-2439 · Note
• https://t.me/cibsecurity/7619 · Telegram Post
• https://packages.altlinux.org/ru/vuln/CVE-2002-2439 · Note