CVE-2002-2439: Integer Overflow
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
Other sources
It was reported that C++ new[] operator was previously missing integer overflow / wrap around checks for its arguments. If an application compiled with gcc accepted untrusted input for memory allocation and was missing application-level checks for integer overflows of arguments, provided to the new[] operator, an attacker could use this flaw to cause the memory region, allocated in the end for the new[] operator statement, it to be smaller than truly required, possibly leading to heap-based buffer overflows.
Upstream bug report: [1] http://gcc.gnu.org/bugzilla/showbug.cgi?id=19351
Upstream patches: [2] http://gcc.gnu.org/ml/gcc-patches/2012-06/msg01689.html [3] http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01416.html
References: [4] http://gcc.gnu.org/bugzilla/showbug.cgi?id=35790 [5] http://cert.uni-stuttgart.de/ticker/advisories/calloc.html
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2002-2439?
CVE-2002-2439 is an integer overflow vulnerability in the new[] operator in gcc before version 4.8.0.
How does CVE-2002-2439 affect the software?
The vulnerability allows attackers to have unspecified impacts on the affected software.
What is the severity of CVE-2002-2439?
The severity of CVE-2002-2439 is high with a severity value of 7.
Which software versions are affected by CVE-2002-2439?
The vulnerability affects gcc before version 4.8.0.
How can I fix CVE-2002-2439?
To fix CVE-2002-2439, update gcc to version 4.8.0 or higher.