Vulnerability CVE-2018-11237: Information

Description

An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed packages

References to Advisories, Solutions, and Tools

1. Affected configurations:

   1. Configuration 1

      cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

      End including

      2.27

      ---

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*

      ---

      Configuration 3

      cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*

      ---

      Configuration 4

      cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:netapp:element_software_management:-:*:*:*:*:*:*:*

      ---

      Configuration 5

      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

      ---