Unscored severity · published Nov 17, 2015
CVE-2015-5276
The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier…
–
CVSS
2.9%
EPSS
No
On KEV
Description
The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Gcc · Gnu
before 4.9.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5276
Mailing List
http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html
Third Party Advisory
http://www.securitytracker.com/id/1034375
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1262846
Issue Tracking
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142
More from Gcc
8.1
CVE-2018-12886
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction…
7.8
CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c
7.8
CVE-2002-2439
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts
7.5
CVE-2019-15847
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy…
6.5
CVE-2021-3826
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a…