CVE-2014-5044: Integer Overflow
Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code.
Upstream fix:
https://gcc.gnu.org/viewcvs/gcc?limitchanges=0&view=revision&revision=211721
These will be included in a later release of GCC.
References:
http://seclists.org/oss-sec/2014/q3/230
Other sources
Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5044?
CVE-2014-5044 has a medium severity level due to the potential for arbitrary code execution.
How do I fix CVE-2014-5044?
To fix CVE-2014-5044, you should update to libgfortran version 4.8 or later.
What are the potential impacts of CVE-2014-5044?
The impacts of CVE-2014-5044 include crashing Fortran applications and executing arbitrary code.
Which software is affected by CVE-2014-5044?
CVE-2014-5044 affects the GNU libgfortran library versions prior to 4.8.
Is CVE-2014-5044 still a risk for my systems?
If you are using an outdated version of libgfortran, CVE-2014-5044 remains a significant risk.