suse/glibc&distro=SUSE Linux Enterprise Server 12 SP3

Vulnerabilities (15)

• CVE-2018-11237May 18, 2018
  affected < 2.22-62.13.2fixed 2.22-62.13.2

  An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.

• CVE-2018-11236May 18, 2018
  affected < 2.22-62.13.2fixed 2.22-62.13.2

  stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitra

• CVE-2017-18269May 18, 2018
  affected < 2.22-62.13.2fixed 2.22-62.13.2

  An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address

• CVE-2018-6551Feb 2, 2018
  affected < 2.22-62.6.2fixed 2.22-62.6.2

  The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requ

• CVE-2018-6485Feb 1, 2018
  affected < 2.22-62.6.2fixed 2.22-62.6.2

  An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

• CVE-2017-1000409Feb 1, 2018
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

• CVE-2017-1000408Feb 1, 2018
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

• CVE-2018-1000001Jan 31, 2018
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

• CVE-2017-16997HigDec 18, 2017
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, relat

• CVE-2017-15804CriOct 22, 2017
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.

• CVE-2017-15671MedOct 20, 2017
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).

• CVE-2017-15670CriOct 20, 2017
  affected < 2.22-62.3.4fixed 2.22-62.3.4

  The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.

• CVE-2017-12133MedSep 7, 2017
  affected < 2.22-62.10.1fixed 2.22-62.10.1

  Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.

• CVE-2017-12132MedAug 1, 2017
  affected < 2.22-62.6.2fixed 2.22-62.6.2

  The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.

• CVE-2017-8804HigMay 7, 2017
  affected < 2.22-62.6.2fixed 2.22-62.6.2

  The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) v