CVE-2006-1902 - Vulnerability Details - OpenCVE

fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gnu	Gcc

Configuration 1 [-]

cpe:2.3:a:gnu:gcc:4.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html
http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html
http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h
http://www.securityfocus.com/archive/1/431184/100/0/threaded
http://www.securityfocus.com/archive/1/431245/100/0/threaded
http://www.securityfocus.com/archive/1/431297/100/0/threaded
http://www.securityfocus.com/archive/1/431319/100/0/threaded

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-04-20T10:00:00

Updated: 2024-08-07T17:27:29.536Z

Reserved: 2006-04-20T00:00:00

Link: CVE-2006-1902

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-04-20T10:02:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-1902

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-03-19T00:00:00", "descriptions": [{"lang": "en", "value": "fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is \"not correctly interpreting an offset to a pointer as a signed value.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/431297/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763"}, {"name": "20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/431245/100/0/threaded"}, {"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/431319/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896"}, {"name": "20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/431184/100/0/threaded"}, {"name": "[gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling broken", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h"}, {"name": "[gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-1902", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is \"not correctly interpreting an offset to a pointer as a signed value.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/431297/100/0/threaded"}, {"name": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763", "refsource": "CONFIRM", "url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763"}, {"name": "20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/431245/100/0/threaded"}, {"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/431319/100/0/threaded"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896", "refsource": "MISC", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896"}, {"name": "20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/431184/100/0/threaded"}, {"name": "[gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling broken", "refsource": "MLIST", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html"}, {"name": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h", "refsource": "CONFIRM", "url": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h"}, {"name": "[gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken", "refsource": "MLIST", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T17:27:29.536Z"}, "title": "CVE Program Container", "references": [{"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/431297/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763"}, {"name": "20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/431245/100/0/threaded"}, {"name": "20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/431319/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896"}, {"name": "20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/431184/100/0/threaded"}, {"name": "[gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling broken", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h"}, {"name": "[gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-1902", "datePublished": "2006-04-20T10:00:00", "dateReserved": "2006-04-20T00:00:00", "dateUpdated": "2024-08-07T17:27:29.536Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:gcc:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "CD2441A8-8FEE-4F96-BB88-3965C747A78B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is \"not correctly interpreting an offset to a pointer as a signed value.\""}], "id": "CVE-2006-1902", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-04-20T10:02:00.000", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896"}, {"source": "cve@mitre.org", "url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763"}, {"source": "cve@mitre.org", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html"}, {"source": "cve@mitre.org", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html"}, {"source": "cve@mitre.org", "url": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/431184/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/431245/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/431297/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/431319/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01297.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://gcc.gnu.org/ml/gcc-bugs/2006-04/msg01298.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/431184/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/431245/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/431297/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/431319/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}