Skip to content
OpenAdvisories
Low ELSA-2023-28766 1 CVE

Low: cross-gcc security update (Oracle Linux 8)

Published Sep 12, 2023 · Updated Sep 12, 2023

Ecosystem: Oracle Linux

Summary

[11.2.1-5.0.2]
- CVE-2023-4039 mitigation.
Orabug 35752004.
- Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 cross-gcc-common 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-aarch64-linux-gnu 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-arm-linux-gnu 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-bpf-unknown-none 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-c++-aarch64-linux-gnu 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-c++-arm-linux-gnu 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-c++-bpf-unknown-none 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-c++-mips64-linux-gnu 0:11.2.1-5.0.2.el8
Oracle Linux · 8 gcc-mips64-linux-gnu 0:11.2.1-5.0.2.el8

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-4039

    GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

    **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-prote…

    GNU Arm gcc Arm GNU Toolchain Debian Ubuntu Azure Linux Alpine Wolfi