CVE-2008-1685: Buffer Overflow
DISPUTED gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1685?
CVE-2008-1685 is considered a medium severity vulnerability due to its potential impact on integer overflow protection in GCC.
How do I fix CVE-2008-1685?
To fix CVE-2008-1685, upgrade to a patched version of GCC, specifically 4.3.1 or later.
Which versions of GCC are affected by CVE-2008-1685?
CVE-2008-1685 affects GCC versions 4.2.0 through 4.3.0.
What type of vulnerability is CVE-2008-1685?
CVE-2008-1685 is a type of integer overflow vulnerability caused by improper handling of pointer arithmetic.
Is CVE-2008-1685 a confirmed vulnerability?
CVE-2008-1685 is disputed; however, it has been acknowledged as a potential issue within the affected versions.