CVE-2018-6485 An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a he...
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.27-1 | 2.27-1 |
| debian/glibc(Debian:13) | < 2.27-1 | 2.27-1 |
| debian/glibc(Debian:14) | < 2.27-1 | 2.27-1 |
| GNU glibc | <= 2.26 | No fix listed |
| redhat virtualization host | = 4.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| oracle communications session border controller | = 8.0.0 | No fix listed |
| oracle communications session border controller | = 8.1.0 | No fix listed |
| oracle communications session border controller | = 8.2.0 | No fix listed |
| oracle enterprise communications broker | = 3.0.0 | No fix listed |
| oracle enterprise communications broker | = 3.1.0 | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| netapp element software management | All versions | No fix listed |
| netapp steelstore cloud integrated storage | All versions | No fix listed |
| netapp storage replication adapter | >= 7.2 | No fix listed |
| netapp vasa provider | >= 7.2 | No fix listed |
| netapp vasa provider | = 6.x | No fix listed |
| netapp virtual storage console | >= 7.2 | No fix listed |
| netapp virtual storage console | All versions | No fix listed |
References
- Debian Security Tracker CVE-2018-6485 vendor-advisory
- bugs.debian.org issue-tracking mailing-list third-party-advisory
- 102912 third-party-advisory vdb-entry
- RHBA-2019:0327 third-party-advisory vendor-advisory
- RHSA-2018:3092 patch third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- sourceware.org issue-tracking third-party-advisory
- USN-4218-1 vendor-advisory
- USN-4416-1 vendor-advisory
- www.oracle.com patch third-party-advisory
- bugs.debian.org issue-tracking