CVE-2018-11236
glibc-source: stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname...
CVE-2018-11236 is fixed in 19 products on 1 platform, first by glibc-source 2.27-3ubuntu1.2, released April 30, 2020. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0692
94th percentile
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| glibc-source · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | glibc-source 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc-bin · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc-bin 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc-dev-bin · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc-dev-bin 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-amd64 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-amd64 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-armel · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-armel 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-dev-amd64 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-dev-amd64 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-dev-armel · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-dev-armel 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-dev-i386 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-dev-i386 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-dev-s390 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-dev-s390 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-dev-x32 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-dev-x32 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-i386 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-i386 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-pic · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-pic 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-s390 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-s390 2.27-3ubuntu1.2 | Apr 30, 2020 |
| libc6-x32 · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | libc6-x32 2.27-3ubuntu1.2 | Apr 30, 2020 |
| locales · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | locales 2.27-3ubuntu1.2 | Apr 30, 2020 |
| locales-all · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | locales-all 2.27-3ubuntu1.2 | Apr 30, 2020 |
| multiarch-support · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | multiarch-support 2.27-3ubuntu1.2 | Apr 30, 2020 |
| nscd · Ubuntu 18.04.6 LTS (bionic) | 2.27-3ubuntu1.2 | nscd 2.27-3ubuntu1.2 | Apr 30, 2020 |