Security update for gcc48 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2380-1 Final 1 1 2017-09-06T12:32:12Z current 2017-09-06T12:32:12Z 2017-09-06T12:32:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gcc48 This update for gcc48 fixes the following issues: Security issues fixed: - A new option -fstack-clash-protection is now offered, which mitigates the stack clash type of attacks. [bnc#1039513] - CVE-2017-11671: Fixed rdrand/rdseed code generation issue [bsc#1050947] Bugs fixed: - Enable LFS support in 32bit libgcov.a. [bsc#1044016] - Bump libffi version in libffi.pc to 3.0.11. - Properly diagnose missing -fsanitize=address support on ppc64le. [bsc#1028744] - Backport patch for PR65612. [bsc#1022062] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-gcc48-13268 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172380-1/ Link for SUSE-SU-2017:2380-1 https://lists.suse.com/pipermail/sle-security-updates/2017-September/003190.html E-Mail link for SUSE-SU-2017:2380-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1011348 SUSE Bug 1011348 https://bugzilla.suse.com/1022062 SUSE Bug 1022062 https://bugzilla.suse.com/1028744 SUSE Bug 1028744 https://bugzilla.suse.com/1039513 SUSE Bug 1039513 https://bugzilla.suse.com/1044016 SUSE Bug 1044016 https://bugzilla.suse.com/1050947 SUSE Bug 1050947 https://www.suse.com/security/cve/CVE-2017-11671/ SUSE CVE CVE-2017-11671 page SUSE Linux Enterprise Software Development Kit 11 SP4 cpp48-4.8.5-5.3.1 gcc48-4.8.5-5.3.1 gcc48-32bit-4.8.5-5.3.1 gcc48-c++-4.8.5-5.3.1 gcc48-fortran-4.8.5-5.3.1 gcc48-fortran-32bit-4.8.5-5.3.1 gcc48-info-4.8.5-5.3.1 gcc48-locale-4.8.5-5.3.1 libasan0-4.8.5-5.3.1 libasan0-32bit-4.8.5-5.3.1 libstdc++48-devel-4.8.5-5.3.1 libstdc++48-devel-32bit-4.8.5-5.3.1 cpp48-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-c++-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-fortran-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-fortran-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-info-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gcc48-locale-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libasan0-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libasan0-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libstdc++48-devel-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libstdc++48-devel-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation. CVE-2017-11671 SUSE Linux Enterprise Software Development Kit 11 SP4:cpp48-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-32bit-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-c++-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-32bit-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-info-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-locale-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-32bit-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-32bit-4.8.5-5.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-4.8.5-5.3.1 moderate 4 AV:N/AC:H/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172380-1/ https://www.suse.com/security/cve/CVE-2017-11671.html CVE-2017-11671 https://bugzilla.suse.com/1050947 SUSE Bug 1050947