CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
Percentile
70.5%
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in
libiberty allows attackers to potentially cause a denial of service
(segmentation fault and crash) via a crafted mangled symbol.
Author | Note |
---|---|
sbeattie | gcc-3.3 only provides libstdc++5 gcc-msp430 is based on gcc-4.6.3 gcc-m68hc1x is based on gcc-3.3.6 gcc-h8300-hms is based on gcc-3.4.6 gcc-i686-linux-android and gcc-arm-linux-androideabi are based on gcc-4.7 |
eslerm | vulnerable function added in gcc-11.1.0 on 2020-05-14 with 3f30a274913 (“libiberty: Update D symbol demangling for latest ABI spec.”) patched for gcc-12.1.0 on 2021-09-23 with 54810401974 (“libiberty: prevent buffer overflow when decoding user input”) |