RHSA-2011:0025: Low: gcc security and bug fix update
The gcc packages include C, C++, Java, Fortran, Objective C, and Ada 95 GNUcompilers, along with related support libraries. The libgcj packageprovides fastjar, an archive tool for Java Archive (JAR) files.Two directory traversal flaws were found in the way fastjar extracted JARarchive files. If a local, unsuspecting user extracted a specially-craftedJAR file, it could cause fastjar to overwrite arbitrary files writable bythe user running fastjar. (CVE-2010-0831, CVE-2010-2322)This update also fixes the following bugs: The option -print-multi-os-directory in the gcc --help output is not in the gcc(1) man page. This update applies an upstream patch to amend this.(BZ#529659) An internal assertion in the compiler tried to check that a C++ static data member is external which resulted in errors. This was because when thecompiler optimizes C++ anonymous namespaces the declarations were no longermarked external as everything on anonymous namespaces is local to thecurrent translation. This update corrects the assertion to resolve thisissue. (BZ#503565, BZ#508735, BZ#582682) Attempting to compile certain .cpp files could have resulted in an internal compiler error. This update resolves this issue. (BZ#527510) PrintServiceLookup.lookupPrintServices with an appropriate DocFlavor failed to return a list of printers under gcj. This update includes abackported patch to correct this bug in the printer lookup service.(BZ#578382) GCC would not build against xulrunner-devel-1.9.2. This update removes gcjwebplugin from the GCC RPM. (BZ#596097) When a SystemTap generated kernel module was compiled, gcc reported an internal compiler error and gets a segmentation fault. This update appliesa patch that, instead of crashing, assumes it can point to anything.(BZ#605803) There was a performance issue with libstdc++ regarding all objects derived from or using std::streambuf because of lock contention betweenthreads. This patch ensures reload uses the same value from Sglobal forthe comparison, Maddreference () and Mimpl member of the class.(BZ#635708)All gcc users should upgrade to these updated packages, which containbackported patches to correct these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0025?
The severity of RHSA-2011:0025 is classified as important due to directory traversal vulnerabilities.
How do I fix RHSA-2011:0025?
To fix RHSA-2011:0025, update the affected gcc packages to version 4.1.2-50.el5 or higher.
What software is affected by RHSA-2011:0025?
RHSA-2011:0025 affects several gcc related packages including gcc, gcc-gfortran, gcc-gnat, and libgcj.
What vulnerabilities does RHSA-2011:0025 address?
RHSA-2011:0025 addresses directory traversal flaws found in the fastjar tool used for handling JAR files.
Is there a workaround for RHSA-2011:0025?
There is no specific workaround for RHSA-2011:0025; applying the update is the recommended solution.