Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause     a denial of service (Fortran application crash) via vectors related to array allocation. (CVE-2014-5044)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has gcc packages installed that are affected by multiple vulnerabilities:

  - Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause     a denial of service (Fortran application crash) via vectors related to array allocation. (CVE-2014-5044)

  - The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not     properly handle short reads from blocking sources, which makes it easier for context-dependent attackers     to predict the random values via unspecified vectors. (CVE-2015-5276)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has gcc packages installed that are affected by multiple vulnerabilities:

  - Multiple integer overflows in libgfortran might allow     remote attackers to execute arbitrary code or cause a     denial of service (Fortran application crash) via     vectors related to array allocation. (CVE-2014-5044)

  - The std::random_device class in libstdc++ in the GNU     Compiler Collection (aka GCC) before 4.9.4 does not     properly handle short reads from blocking sources, which     makes it easier for context-dependent attackers to     predict the random values via unspecified vectors.
    (CVE-2015-5276)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated gcc packages fix the following security issue :

Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code CVE-2014-5044).

They also fix the following bugs :

The gcc rtl-optimization sched2 miscompiles syscall sequence wich can cause random panic in glibc and kernel (gcc/PR61801)

clang++ fails to find cxxabi.h and cxxabi_tweaks.h during build (mga#13543)

ID	Name	Product	Family	Severity
218364	Linux Distros Unpatched Vulnerability : CVE-2014-5044	Nessus	Misc.	critical
160739	NewStart CGSL CORE 5.04 / MAIN 5.04 : gcc Multiple Vulnerabilities (NS-SA-2022-0019)	Nessus	NewStart CGSL Local Security Checks	critical
132504	NewStart CGSL CORE 5.05 / MAIN 5.05 : gcc Multiple Vulnerabilities (NS-SA-2019-0233)	Nessus	NewStart CGSL Local Security Checks	critical
82446	Mandriva Linux Security Advisory : gcc (MDVSA-2015:170)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2014-5044

critical

Tenable Plugins

critical

critical

critical

high