CVE-2015-5276

The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.
References
Link Resource
http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html Mailing List Third Party Advisory
http://www.securitytracker.com/id/1034375 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1262846 Issue Tracking Third Party Advisory
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-11-17 15:59

Updated : 2024-02-04 18:53


NVD link : CVE-2015-5276

Mitre link : CVE-2015-5276

CVE.ORG link : CVE-2015-5276


JSON object : View

Products Affected

gnu

  • gcc
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor