Orc: Arbitrary Code Execution — GLSA 202505-05

A vulnerability has been discovered in Orc, which can lead to arbitrary code execution

Affected packages

dev-lang/orc on all architectures
Affected versions < 0.4.40
Unaffected versions >= 0.4.40

Background

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Description

Please review the CVE identifier referenced below for details.

Impact

It is possible for a malicious third party to trigger a buffer overflow and effect code execution with the same privileges as the orc compiler is called with by feeding it with malformed orc source files. This only affects developers and CI environments using orcc, not users of liborc.

Workaround

There is no known workaround at this time.

Resolution

All Orc users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-lang/orc-0.4.40"
 

References

Release date
May 12, 2025

Latest revision
May 12, 2025: 1

Severity
high

Exploitable
local

Bugzilla entries