CVE-2008-1685 Integer overflow in n/a
GCC compiler optimization may remove bounds checks, potentially enabling buffer overflows in compiled software, affecting developers and security auditors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-1685?
CVE-2008-1685 is a medium-severity vulnerability in n/a, published on 6 Apr 2008.
Official description
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)
Which versions are affected by CVE-2008-1685?
It affects 1 product.
Products include Gnu Gcc.
How do I fix CVE-2008-1685?
No fix has been published for CVE-2008-1685 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-1685 being exploited?
There is no known exploitation of CVE-2008-1685 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6pf5-463c-qv74.