* Charo: > Is there any private list or something like that to report it > or should I use the GCC bug tracker? You could pick one of the distributions and let them handle this: * Debian <security@debian.org> * Red Hat <secalert@redhat.com> * SUSE <security@suse.com> Just contacting one distribution is sufficient.