A vulnerability has been discovered in Orc, which can lead to arbitrary code execution
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/orc | * | < 0.4.40 | >= 0.4.40 |
Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.
Please review the CVE identifier referenced below for details.
It is possible for a malicious third party to trigger a buffer overflow and effect code execution with the same privileges as the orc compiler is called with by feeding it with malformed orc source files. This only affects developers and CI environments using orcc, not users of liborc.
There is no known workaround at this time.
All Orc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/orc-0.4.40"