Source: gcc-12 X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for gcc-12. CVE-2026-114690[0]: | A flaw was found in GCC. An out-of-bounds memory access | vulnerability exists in the libstdc++ parallel search implementation | due to an undersized internal buffer. A local attacker can exploit | this flaw by providing crafted search data to an application | compiled with parallel mode, causing the process to crash and | leading to a Denial of Service (DoS). https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c1f32b67510f6f9998deadaef5090b6663adb979 (main) https://bugzilla.redhat.com/show_bug.cgi?id=2478652 CVE-2026-114691[1]: | A flaw was found in the libstdc++ component of GCC. An attacker who | can provide an excessively large element count to a boolean vector | (std::vector<bool>) constructor can trigger an integer wrap during | internal memory calculations. This issue leaves the container in an | inconsistent state, leading to out-of-bounds memory access and | resulting in an application crash or a Denial of Service (DoS) | during subsequent operations. https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=2fd8866591b5aea7098835f80ab7e176382175ae https://bugzilla.redhat.com/show_bug.cgi?id=2478508 CVE-2026-115455[2]: | A flaw was found in GCC libstdc++. When an application extracts data | into a bitset from a wide-character stream, internal stack memory | allocation fails to properly account for character size and | alignment. An attacker capable of supplying crafted input to an | affected application could trigger a stack-based buffer overflow | leading denial of service (DoS). https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219 https://bugzilla.redhat.com/show_bug.cgi?id=2562933 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-114690 https://www.cve.org/CVERecord?id=CVE-2026-114690 [1] https://security-tracker.debian.org/tracker/CVE-2026-114691 https://www.cve.org/CVERecord?id=CVE-2026-114691 [2] https://security-tracker.debian.org/tracker/CVE-2026-115455 https://www.cve.org/CVERecord?id=CVE-2026-115455 Please adjust the affected versions in the BTS as needed.
