Description
Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gcc-4.7 +4 | No fix yet | — |
| Ubuntu 14.04 LTS | gcc-4.7 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | gcc-4.8 | 4.8.4-2ubuntu1~14.04 | — |
| Ubuntu 14.04 LTS | gcc-4.8-arm64-cross +1 | 0.11.1 | — |
References
- libgfortran-cve20145044-overflow(94849) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1122812
- [oss-security] 20140731 Re: Re: [CVE request] Array allocation fixes in libgfortran mailing-list
- https://gcc.gnu.org/viewcvs/gcc/trunk/libgfortran/ChangeLog?limit_changes=0&view=markup&pathrev=211721
- [oss-security] 20140723 Re: [CVE request] Array allocation fixes in libgfortran mailing-list