PatchTheCVEgcc vulnerabilities and fixes
Recent CVEs affecting gcc, with upgrade or downgrade steps. 11 tracked.
gcc has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2023-09-13. Highest priority: CVE-2018-12886 (score 60/100).
- CVE-2023-4039 MEDIUM 4.8 UPGRADE **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an
- CVE-2022-27943 MEDIUM 5.5 DOWNGRADE MITIGATE libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-ne
- CVE-2021-46195 MEDIUM 5.5 DOWNGRADE GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c
- CVE-2021-3826 MEDIUM 6.5 DOWNGRADE MITIGATE Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potent
- CVE-2019-15847 HIGH 7.5 UPGRADE MITIGATE The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __b
- CVE-2018-12886 HIGH 8.1 UPGRADE stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC
- CVE-2021-37322 HIGH 7.8 UPGRADE UPGRADE GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- CVE-2017-11671 MEDIUM 4.0 DOWNGRADE Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) versi
- CVE-2015-5276 MEDIUM 5.0 UPGRADE The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not prope
- CVE-2013-4598 MEDIUM 5.0 DOWNGRADE The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissi
- CVE-2002-2439 HIGH 7.8 UPGRADE Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
FAQ
How do I fix gcc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gcc being exploited right now?
None of the tracked gcc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gcc CVE should I patch first?
CVE-2018-12886 currently ranks highest (60/100): stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC.