CVE-2018-6551 The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close t...
CriticalCVSS 9.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.27-1 | 2.27-1 |
| debian/glibc(Debian:13) | < 2.27-1 | 2.27-1 |
| debian/glibc(Debian:14) | < 2.27-1 | 2.27-1 |
| GNU glibc | >= 2.24, <= 2.26 | No fix listed |
References
- Debian Security Tracker CVE-2018-6551 vendor-advisory
- security.netapp.com
- sourceware.org issue-tracking mailing-list third-party-advisory
- sourceware.org