SB2020052620 - OpenSUSE Linux update for gcc9

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020052620

SB2020052620 - OpenSUSE Linux update for gcc9

Published: May 26, 2020

Security Bulletin ID SB2020052620
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2019-14250)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in simple_object_elf_match() function in simple-object-elf.c. A remote attacker can use a specially crFted ELF file to trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2019-15847)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to the POWER9 backend in GNU Compiler Collection (GCC) can optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This vulnerability may weaken security features that rely on random number generator.


Remediation

Install update from vendor's website.

References