Bug 517930 – <sys-devel/gcc-{4.8.4,4.9.2,5.1.0}: integer overflows in libgfortran (CVE-2014-5044)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-07-24 07:50:16 UTC]

From ${URL} :

Janne Blomqvist fixed several CVE-2002-0391-style integer overflows in 
array allocation in libgfortran, the run-time support library for the 
Fortran compiler which is part of the GNU Compiler Collection.  The 
upstream Subversion commit is here:

 
<https://gcc.gnu.org/viewcvs/gcc?limit_changes=0&view=revision&revision=211721>

These changes will be part of the next version of GCC (whose version 
number is still to be decided).



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 SpanKY 2015-12-05 21:35:21 UTC]

the fixes are included in these releases:
  gcc-4.8.4
  gcc-4.8.5
  gcc-4.9.2
  gcc-4.9.3
  gcc-5.1.0
  gcc-5.2.0
  gcc-5.3.0

and we've marked 4.8/4.9 versions stable at this point

[Comment 2 Thomas Deutschmann (RETIRED) 2016-11-22 13:21:29 UTC]

@ Maintainer(s): Previous versions *are* affected. Please consider cleanup or apply masks or even backport fixes...

[Comment 3 SpanKY 2016-11-22 20:35:56 UTC]

backports might happen, but we aren't doing anything other than that

[Comment 4 Yury German 2017-06-03 06:00:05 UTC]

Thank you for masking the rest of the packages.