openSUSE Security Update : gcc9 (openSUSE-2020-716)

high Nessus Plugin ID 136959

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update includes the GNU Compiler Collection 9.

This update ships the GCC 9.3 release.

A full changelog is provided by the GCC team on :

https://www.gnu.org/software/gcc/gcc-9/changes.html

The base system compiler libraries libgcc_s1, libstdc++6 and others are now built by the gcc 9 packages.

To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 / CXX=g++-9 during configuration for using it.

Security issues fixed :

- CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the
__builtin_darn intrinsic into a single call.
(bsc#1149145)

- CVE-2019-14250: Fixed a heap overflow in the LTO linker.
(bsc#1142649)

Non-security issues fixed :

- Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime.
(bsc#1135254)

- Fixed miscompilation for vector shift on s390.
(bsc#1141897)

- Includes a fix for Internal compiler error when building HepMC (bsc#1167898)

- Includes fix for binutils version parsing

- Add libstdc++6-pp provides and conflicts to avoid file conflicts with same minor version of libstdc++6-pp from gcc10.

- Add gcc9 autodetect -g at lto link (bsc#1149995)

- Install go tool buildid for bootstrapping go

Solution

Update the affected gcc9 packages.

Plugin Details

Severity: High

ID: 136959

File Name: openSUSE-2020-716.nasl

Version: 1.3

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 5/29/2020

Updated: 3/8/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2019-15847

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libstdc%2b%2b6-pp-gcc9-32bit, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-locale, p-cpe:/a:novell:opensuse:libatomic1-32bit, p-cpe:/a:novell:opensuse:libstdc%2b%2b6, p-cpe:/a:novell:opensuse:liblsan0-debuginfo, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-debuginfo, p-cpe:/a:novell:opensuse:libgomp1-32bit, p-cpe:/a:novell:opensuse:libgcc_s1-32bit-debuginfo, p-cpe:/a:novell:opensuse:libubsan1-32bit, p-cpe:/a:novell:opensuse:libasan5-debuginfo, p-cpe:/a:novell:opensuse:gcc9-fortran-debuginfo, p-cpe:/a:novell:opensuse:gcc9-go-debuginfo, p-cpe:/a:novell:opensuse:libitm1-32bit, p-cpe:/a:novell:opensuse:libquadmath0-32bit-debuginfo, p-cpe:/a:novell:opensuse:libtsan0, p-cpe:/a:novell:opensuse:libgfortran5-32bit-debuginfo, p-cpe:/a:novell:opensuse:libgo14-32bit-debuginfo, p-cpe:/a:novell:opensuse:libgcc_s1, p-cpe:/a:novell:opensuse:libquadmath0-debuginfo, p-cpe:/a:novell:opensuse:cross-nvptx-gcc9-debuginfo, p-cpe:/a:novell:opensuse:libgomp1-debuginfo, p-cpe:/a:novell:opensuse:libgomp1-32bit-debuginfo, p-cpe:/a:novell:opensuse:gcc9-debuginfo, cpe:/o:novell:opensuse:15.1, p-cpe:/a:novell:opensuse:gcc9-info, p-cpe:/a:novell:opensuse:gcc9, p-cpe:/a:novell:opensuse:cpp9-debuginfo, p-cpe:/a:novell:opensuse:libgo14-debuginfo, p-cpe:/a:novell:opensuse:libgfortran5-debuginfo, p-cpe:/a:novell:opensuse:cross-nvptx-gcc9-debugsource, p-cpe:/a:novell:opensuse:libada9-debuginfo, p-cpe:/a:novell:opensuse:libubsan1-debuginfo, p-cpe:/a:novell:opensuse:libada9-32bit, p-cpe:/a:novell:opensuse:gcc9-debugsource, p-cpe:/a:novell:opensuse:gcc9-c%2b%2b, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-32bit-debuginfo, p-cpe:/a:novell:opensuse:libasan5, p-cpe:/a:novell:opensuse:libada9-32bit-debuginfo, p-cpe:/a:novell:opensuse:gcc9-c%2b%2b-debuginfo, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-devel-gcc9-32bit, p-cpe:/a:novell:opensuse:libquadmath0-32bit, p-cpe:/a:novell:opensuse:gcc9-locale, p-cpe:/a:novell:opensuse:cross-nvptx-newlib9-devel, p-cpe:/a:novell:opensuse:gcc9-32bit, p-cpe:/a:novell:opensuse:gcc9-go-32bit, p-cpe:/a:novell:opensuse:libasan5-32bit, p-cpe:/a:novell:opensuse:libitm1-debuginfo, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-pp-gcc9, p-cpe:/a:novell:opensuse:libtsan0-debuginfo, p-cpe:/a:novell:opensuse:gcc9-ada-debuginfo, p-cpe:/a:novell:opensuse:gcc9-fortran, p-cpe:/a:novell:opensuse:libgo14, p-cpe:/a:novell:opensuse:libgcc_s1-32bit, p-cpe:/a:novell:opensuse:libquadmath0, p-cpe:/a:novell:opensuse:libatomic1-32bit-debuginfo, p-cpe:/a:novell:opensuse:libatomic1-debuginfo, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-devel-gcc9, p-cpe:/a:novell:opensuse:cpp9, p-cpe:/a:novell:opensuse:gcc9-c%2b%2b-32bit, p-cpe:/a:novell:opensuse:libasan5-32bit-debuginfo, p-cpe:/a:novell:opensuse:libgo14-32bit, p-cpe:/a:novell:opensuse:libitm1-32bit-debuginfo, p-cpe:/a:novell:opensuse:libatomic1, p-cpe:/a:novell:opensuse:libgomp1, p-cpe:/a:novell:opensuse:gcc9-ada-32bit, p-cpe:/a:novell:opensuse:libubsan1, p-cpe:/a:novell:opensuse:libitm1, p-cpe:/a:novell:opensuse:libgfortran5, p-cpe:/a:novell:opensuse:cross-nvptx-gcc9, p-cpe:/a:novell:opensuse:libada9, p-cpe:/a:novell:opensuse:gcc9-go, p-cpe:/a:novell:opensuse:libstdc%2b%2b6-32bit, p-cpe:/a:novell:opensuse:gcc9-ada, p-cpe:/a:novell:opensuse:libgfortran5-32bit, p-cpe:/a:novell:opensuse:libgcc_s1-debuginfo, p-cpe:/a:novell:opensuse:libubsan1-32bit-debuginfo, p-cpe:/a:novell:opensuse:gcc9-fortran-32bit, p-cpe:/a:novell:opensuse:liblsan0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/26/2020

Vulnerability Publication Date: 7/24/2019

Reference Information

CVE: CVE-2019-14250, CVE-2019-15847

Detections

Analytics