Bug 13846

Please patch CVEs for package gcc version 11.2.0
  
INFO (CVEs are): gcc 11.2.0
 cves found
CVE-2023-4039
Desc: 

A failure in the -fstack-protector feature in GCC-based toolchains 
that target AArch64 allows an attacker to exploit an existing buffer 
overflow in dynamically-sized local variables in your application 
without this being detected. This stack-protector failure only applies 
to C99-style dynamically-sized local variables or those created using 
alloca(). The stack-protector operates as intended for statically-sized 
local variables.

The default behavior when the stack-protector 
detects an overflow is to terminate your application, resulting in 
controlled loss of availability. An attacker who can exploit a buffer 
overflow without triggering the stack-protector might be able to change 
program flow control to cause an uncontrolled loss of availability or to
 go further and affect confidentiality or integrity.






Link: https://nvd.nist.gov/vuln/detail/CVE-2023-4039
Severity: MEDIUM