<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for gcc48</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2017:2380-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-09-06T12:32:12Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-09-06T12:32:12Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-09-06T12:32:12Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for gcc48</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for gcc48 fixes the following issues:

Security issues fixed:

- A new option -fstack-clash-protection is now offered, which mitigates the stack clash type of attacks. [bnc#1039513]
- CVE-2017-11671: Fixed rdrand/rdseed code generation issue [bsc#1050947]

Bugs fixed:

- Enable LFS support in 32bit libgcov.a.  [bsc#1044016]
- Bump libffi version in libffi.pc to 3.0.11.
- Properly diagnose missing -fsanitize=address support on ppc64le.  [bsc#1028744]
- Backport patch for PR65612. [bsc#1022062]

</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">sdksp4-gcc48-13268</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172380-1/</URL>
      <Description>Link for SUSE-SU-2017:2380-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2017-September/003190.html</URL>
      <Description>E-Mail link for SUSE-SU-2017:2380-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1011348</URL>
      <Description>SUSE Bug 1011348</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1022062</URL>
      <Description>SUSE Bug 1022062</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1028744</URL>
      <Description>SUSE Bug 1028744</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1039513</URL>
      <Description>SUSE Bug 1039513</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1044016</URL>
      <Description>SUSE Bug 1044016</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1050947</URL>
      <Description>SUSE Bug 1050947</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-11671/</URL>
      <Description>SUSE CVE CVE-2017-11671 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4" CPE="cpe:/a:suse:sle-sdk:11:sp4">SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="cpp48-4.8.5-5.3.1">
      <FullProductName ProductID="cpp48-4.8.5-5.3.1">cpp48-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-4.8.5-5.3.1">gcc48-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-32bit-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-32bit-4.8.5-5.3.1">gcc48-32bit-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-c++-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-c++-4.8.5-5.3.1">gcc48-c++-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-fortran-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-fortran-4.8.5-5.3.1">gcc48-fortran-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-fortran-32bit-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-fortran-32bit-4.8.5-5.3.1">gcc48-fortran-32bit-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-info-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-info-4.8.5-5.3.1">gcc48-info-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gcc48-locale-4.8.5-5.3.1">
      <FullProductName ProductID="gcc48-locale-4.8.5-5.3.1">gcc48-locale-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libasan0-4.8.5-5.3.1">
      <FullProductName ProductID="libasan0-4.8.5-5.3.1">libasan0-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libasan0-32bit-4.8.5-5.3.1">
      <FullProductName ProductID="libasan0-32bit-4.8.5-5.3.1">libasan0-32bit-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libstdc++48-devel-4.8.5-5.3.1">
      <FullProductName ProductID="libstdc++48-devel-4.8.5-5.3.1">libstdc++48-devel-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libstdc++48-devel-32bit-4.8.5-5.3.1">
      <FullProductName ProductID="libstdc++48-devel-32bit-4.8.5-5.3.1">libstdc++48-devel-32bit-4.8.5-5.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="cpp48-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:cpp48-4.8.5-5.3.1">cpp48-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-4.8.5-5.3.1">gcc48-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-32bit-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-32bit-4.8.5-5.3.1">gcc48-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-c++-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-c++-4.8.5-5.3.1">gcc48-c++-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-fortran-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-4.8.5-5.3.1">gcc48-fortran-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-fortran-32bit-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-32bit-4.8.5-5.3.1">gcc48-fortran-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-info-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-info-4.8.5-5.3.1">gcc48-info-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="gcc48-locale-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-locale-4.8.5-5.3.1">gcc48-locale-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libasan0-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-4.8.5-5.3.1">libasan0-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libasan0-32bit-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-32bit-4.8.5-5.3.1">libasan0-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libstdc++48-devel-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-4.8.5-5.3.1">libstdc++48-devel-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libstdc++48-devel-32bit-4.8.5-5.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-32bit-4.8.5-5.3.1">libstdc++48-devel-32bit-4.8.5-5.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.</Note>
    </Notes>
    <CVE>CVE-2017-11671</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:cpp48-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-32bit-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-c++-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-32bit-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-fortran-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-info-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:gcc48-locale-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-32bit-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:libasan0-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-32bit-4.8.5-5.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 11 SP4:libstdc++48-devel-4.8.5-5.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20172380-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-11671.html</URL>
        <Description>CVE-2017-11671</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1050947</URL>
        <Description>SUSE Bug 1050947</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
