|
Vulnerabilities
< Back

CVE-2018-11236

Updated on 18 May 2018

Severity

9.8 Critical severity

Details

CVSS score
9.8
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Details

Affected product:
AlmaLinux 8 , AlmaLinux 9.2 ESU , CentOS 6 , CentOS 6 ELS , CentOS 7 , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CloudLinux 6 ELS , Debian 10 , Debian 9 , Oracle Linux 6 ELS , Oracle Linux 7 , RHEL 6 , RHEL 7 , RHEL 8 , Ubuntu 16.04 , Ubuntu 16.04 ELS , Ubuntu 16.04 ESM , Ubuntu 18.04 , Ubuntu 18.04 ELS , Ubuntu 20.04
Affected packages:
glibc @ - (+21 more)
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Fixes