Unscored severity · published Apr 6, 2008
CVE-2008-1685
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead…
–
CVSS
1.3%
EPSS
No
On KEV
Description
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Gcc · Gnu
4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1685
gcc.gnu.org
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
US Government Resource
http://www.kb.cert.org/vuls/id/162289
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/41686
More from Gcc
8.1
CVE-2018-12886
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction…
7.8
CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c
7.8
CVE-2002-2439
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts
7.5
CVE-2019-15847
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy…
6.5
CVE-2021-3826
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a…