CVE-2008-1685

** DISPUTED ** gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999).

Link	Resource
http://www.kb.cert.org/vuls/id/162289	US Government Resource
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
https://exchange.xforce.ibmcloud.com/vulnerabilities/41686

Configuration 1

cpe:2.3:a:gnu:gcc:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:gnu:gcc:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:gnu:gcc:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:gnu:gcc:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:gnu:gcc:4.3.0:*:*:*:*:*:*:* cpe:2.3:a:gnu:gcc:4.2.2:*:*:*:*:*:*:*

---

Published : 2008-04-06 11:44

Updated : 2017-08-08 01:30

---

NVD link : CVE-2008-1685

Mitre link : CVE-2008-1685

No products.

CWE-733