CVE-2008-1685
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection…
Does this matter?
Lower severity and a low EPSS score (1.25%). Track it; it rarely justifies an emergency change on its own.
Description
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.25% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-189
- Affected
- gnu/gcc
- Source
- cve@mitre.org
References
- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
- http://www.kb.cert.org/vuls/id/162289US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41686
- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
- http://www.kb.cert.org/vuls/id/162289US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41686
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.