Skip to content
OpenAdvisories
Medium 1 exploited CVE ELSA-2025-1301 1 CVE

Moderate: gcc security update (Oracle Linux 8)

Published Feb 12, 2025 · Updated Feb 12, 2025

Summary

[8.5.0-23.0.1]
- Merge Oracle patches to 8.5.0-23.
Oracle history:
May-22-2024 Qing Zhao <qing.zhao@oracle.com> 8.5.0-22.0.1
- Merge Oracle patches to 8.5.0-22.
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
March-27-2024 Qing Zhao <qing.zhao@oracle.com> 8.5.0-21.0.1
- Merge Oracle patches to 8.5.0-21.
January-19-2024 Qing Zhao <qing.zhao@oracle.com> 8.5.0-20.0.3
- Fix Orabug 35283123, i.e, the same bug as GCC PR111407.
gcc14-pr111407.patch
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
January-5-2024 Jose E. Marchesi <jose.marchesi@oracle.com> 8.5.0-20.0.2
- Restore support for -mpreserve-args in aarch64 targets, adapted to
new AArch64 stack frame layout.
Reviewed-by: Cupertino Miranda <cupertino.miranda@oracle.com>
October-4-2023 David Faust <david.faust@oracle.com> 8.5.0-20.0.1
- Forward-port Oracle patches
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
September-28-2023 David Faust <david.faust@oracle.com> 8.5.0-18.0.6
- Backport additional patches from gcc-9 to fix CVE-2023-4039 patches
interaction with backported aarch64 -fstack-clash-protection support.
[Orabug 35843962]
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
August-31-2023 Qing Zhao <qing.zhao@oracle.com> 8.5.0-18.0.5
- CVE-2023-4039 GCC mitigation.
Orabug 35751743.
Includes removal of aarch64-preserve-args.patch.
- CVE-2022-40982 'Intel Downfall' mitigation.
Orabug 35751810.
Add two patches originally from GCC upstream releases/gcc-11 branch.
with major adjustment.
gcc11-downfall-disable-gather-in-vec.patch
gcc11-downfall-support-mno-gather.patch
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
May-11-2023 Jose E. Marchesi <jose.marchesi@oracle.com> 8.5.0-18.0.2
- Support for -mpreserve-args in aarch64.
Orabug 35065765.
Reviewed-by: Qing Zhao <qing.zhao@oracle.com>.
March-28-2023 Qing Zhao <qing.zhao@oracle.com> 8.5.0-18.0.1
- Merge Oracle patches with gcc-8.5.0-18.
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
January-12-2023 Qing Zhao <qing.zhao@oracle.com> 8.5.0-16.0.1
- Merge oracle patches with gcc-8.5.0-16.
November-30-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-15.0.2
- Fix Orabug 34679540 - PROFILE COLLECT BUILD AND WORK LOAD TEST
ISSUES IN LINUX ARM64.
Removing the buggy patch that has been removed from upstream gcc too:
gcc10-pr91971.patch
September-28-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-15.0.1
- Merge oracle patches with gcc-8.5.0-15.
June-29-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-10.1.0.1
- Merge oracle patches with gcc-8.5.0-10.1.el8_6.
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
May-4-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-10.0.2
- Fix Orabug 34066706 only in OL GCC.
report error when there is no PROGRAM_SUMMARY section in .gcda file.
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
April-27-2022 Marek Polacek <polacek@redhat.com> 8.5.0-10.1
- backport Default widths with -fdec-format-defaults patch (#2079578)
March-22-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-10.0.1
- Merge with oracle patches.
January-5-2022 Qing Zhao <qing.zhao@oracle.com> 8.5.0-4.0.2
- Add patches to support marvell on Arm:
gcc9-add-support-for-profile-extension.patch
gcc10-add-initial-octeontx2-support.patch
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
November-16-2021 Qing Zhao <qing.zhao@oracle.com> 8.5.0-4.0.1
- Merge oracle patches to security errata 8.5.0-4.
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
October-14-2021 Indu Bhagat <indu.bhagat@oracle.com> 8.5.0-3.0.2
- Fix Orabug 33451471 and backport CTF/BTF enhancements
ctfc: Free CTF container elements in ctfc_delete_container ()
ctf: Do not warn for CTF not supported for GNU GIMPLE
ICE in btf_finalize when compiling with -gbtf (PR debug/102507, Orabug
33451471)
Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
October-5-2021 Qing Zhao <qing.zhao@oracle.com> 8.5.0-3.0.1
- Merge the following oracle patches to OL8.5 beta:
- Fix an aarch64 compilation error triggered by the oracle patch
gcc9-multiple-changes-align.patch on OL8U5 source base.
gcc-fix-aarch64-tune-params.patch
- Fix Orabug 33281392 Update CTF and BTF support in OL8 GCC
This commit brings the support for CTF/BTF debug formats at par with
upstream. GCC now generates the CTF/BTF debug information by using the
internal DWARF representation.
For backward compatibility reasons, OL8 GCC continues to support -gt
command line option.
(Indu Bhagat <indu.bhagat@oracle.com> 8.4.1-1.0.3)
- Add complex divide improvement
backport of upstream commit 54f0224d55a1b56dde092460ddf76913670e6efc
(Patrick.McGehearty <patrick.mcgehearty@oracle.com> 8.4.1-1.0.2)
- Fix Orabug 32301371 - bug using gcov with preserve paths option
This is the same bug as GCC bug PR gcov-profile/88994
gcc9-pr88994.patch
(Qing Zhao <qing.zhao@oracle.com> 8.3.1-5.1.0.2)
- Fix generation of CTF type records for completed structs referred
thru pointers.
Orabug 31095790.
(Jose E. Marchesi <jose.marchesi@oracle.com> 8.3.1-5.0.4)
- Fix Orabug 29838827 - provide an option to adjust the maximum depth
of nested #include
This is the same bug as gcc upstream PR90581 from Gcc9:
gcc9-pr90581.patch
- Fix Orabug 29541051 - confusing error message when there is a problem
with ASAN_OPTIONS 'ERROR: expected '=''
This is the same bug as gcc upstream PR89832 from Gcc9:
gcc9-pr89832.patch
(Qing Zhao <qing.zhao@oracle.com> 8.3.1-5.0.3)
- Update support for CTF
Fix Orabug 30833294 GCC generates incorrect CTF for single element arrays
Fix Orabug 30808764 CTF generation fails when __attribute__ ((mode (XX))) is
used
(Indu Bhagat <indu.bhagat@oracle.com> 8.3.1-5.0.2)
- Apply ares/neoverse support patches only ifarch aarch64.
(Qing Zhao <qing.zhao@oracle.com> 8.3.1-4.5.0.6)
- Add 4 patches from gcc9 to support Arm Ares and Neoverse-N1 for Aarch64
gcc9-add-vec-reverse.patch
gcc9-multiple-changes-align.patch
gcc9-initial-mcpu-ares-tuning.patch
g

Fixed packages 28

ReleasePackageFixed in
Oracle Linux · 8 cpp 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-c++ 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-gdb-plugin 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-gfortran 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-offload-nvptx 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-plugin-annobin 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 gcc-plugin-devel 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libasan 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libatomic 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libatomic-static 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libgcc 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libgfortran 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libgfortran-static 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libgomp 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libgomp-offload-nvptx 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libitm 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libitm-devel 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 liblsan 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libquadmath 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libquadmath-devel 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libquadmath-static 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libstdc++ 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libstdc++-devel 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libstdc++-docs 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libstdc++-static 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libtsan 0:8.5.0-23.0.1.el8_10
Oracle Linux · 8 libubsan 0:8.5.0-23.0.1.el8_10

Vulnerabilities 1

  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    KEV Jan 23, 2025