CVE-2018-6485
glibc: Integer overflow in posix_memalign in memalign functions
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (medium).
Description
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | glibc | 2.22-19.ph1 |
| Photon OS 2.0 | glibc | 2.26-10.ph2 |
| amazon linux 1 | glibc, glibc-common, glibc-debuginfo and 6 more | 2.17-260.175.amzn1 |
| amazon linux 2 | glibc, glibc-all-langpacks, glibc-benchtests and 198 more | 2.26-27.amzn2.0.4 |
| debian 11 | glibc | 2.27-1 |
| debian 12 | glibc | 2.27-1 |
| debian 13 | glibc | 2.27-1 |
| debian 14 | glibc | 2.27-1 |
| debian 7 | eglibc | no fix listed |
| echo | glibc | 2.27-1 |
| Oracle Linux 7 | glibc, glibc-common, glibc-devel and 4 more | 2.17-260.0.9.el7 |
| Red Hat | compat-glibc, compat-glibc-headers, glibc and 6 more | no fix listed |
Show all 244 entries from 20 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | glibc | 2.22-19.ph1 |
| Photon OS 2.0 | glibc | 2.26-10.ph2 |
| amazon linux 1 | glibc | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-common | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-debuginfo | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-debuginfo-common | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-devel | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-headers | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-static | 2.17-260.175.amzn1 |
| amazon linux 1 | glibc-utils | 2.17-260.175.amzn1 |
| amazon linux 1 | nscd | 2.17-260.175.amzn1 |
| amazon linux 2 | glibc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-all-langpacks | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-benchtests | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-common | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-debuginfo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-debuginfo-common | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-devel | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-headers | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-aa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-af | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ak | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-am | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-an | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-anp | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ar | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-as | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ast | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ayc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-az | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-be | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bem | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ber | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bhb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bho | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-br | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-brx | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-byn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ca | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ce | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-chr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cmn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-crh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-csb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-da | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-de | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-doi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-dv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-dz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-el | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-en | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-eo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-es | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-et | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-eu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ff | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fil | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fur | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ga | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gez | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ha | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hak | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-he | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hne | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hsb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ht | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ia | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-id | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ig | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ik | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-is | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-it | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-iu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ja | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ka | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-km | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ko | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kok | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ks | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ku | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ky | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-li | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lij | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ln | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lzh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mag | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mai | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mhr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ml | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mni | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ms | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-my | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nan | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nds | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ne | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nhn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-niu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nso | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-oc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-om | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-or | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-os | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pap | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ps | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-quz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-raj | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ro | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ru | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-rw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sat | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-se | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sgs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-shs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-si | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sid | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-so | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sq | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ss | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-st | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-szl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ta | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tcy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-te | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-th | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-the | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ti | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tig | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ts | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ug | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-uk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-unm | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ur | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-uz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ve | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-vi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wae | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wal | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-xh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yue | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-zh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-zu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-locale-source | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-minimal-langpack | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-nss-devel | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-static | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-utils | 2.26-27.amzn2.0.4 |
| amazon linux 2 | libcrypt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | libcrypt-nss | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nscd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_db | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_hesiod | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_nis | 2.26-27.amzn2.0.4 |
| debian 11 | glibc | 2.27-1 |
| debian 12 | glibc | 2.27-1 |
| debian 13 | glibc | 2.27-1 |
| debian 14 | glibc | 2.27-1 |
| debian 7 | eglibc | no fix listed |
| echo | glibc | 2.27-1 |
| Oracle Linux 7 | glibc | 2.17-260.0.9.el7 |
| Oracle Linux 7 | glibc-common | 2.17-260.0.9.el7 |
| Oracle Linux 7 | glibc-devel | 2.17-260.0.9.el7 |
| Oracle Linux 7 | glibc-headers | 2.17-260.0.9.el7 |
| Oracle Linux 7 | glibc-static | 2.17-260.0.9.el7 |
| Oracle Linux 7 | glibc-utils | 2.17-260.0.9.el7 |
| Oracle Linux 7 | nscd | 2.17-260.0.9.el7 |
| Red Hat | compat-glibc | no fix listed |
| Red Hat | compat-glibc-headers | no fix listed |
| Red Hat | glibc | no fix listed |
| Red Hat | glibc-common | no fix listed |
| Red Hat | glibc-devel | no fix listed |
| Red Hat | glibc-headers | no fix listed |
| Red Hat | glibc-static | no fix listed |
| Red Hat | glibc-utils | no fix listed |
| Red Hat | nscd | no fix listed |
| root.io debian 11 | rootio-glibc | 2.27-1 |
| root.io debian 12 | rootio-glibc | 2.27-1 |
| root.io debian 13 | rootio-glibc | 2.27-1 |
| seal Red Hat 8 | glibc | 2.28-164.0.5.el8_5.3+sp999, 2.28-251.el8_10.11+sp999, 2.28-251.el8_10.14+sp999 |
| seal Red Hat 8 | seal-glibc | 2.28-164.0.5.el8_5.3+sp999, 2.28-251.el8_10.11+sp999, 2.28-251.el8_10.14+sp999 |
| seal Red Hat 9 | glibc | 2.34-125.el9_5.1+sp999 |
| seal Red Hat 9 | seal-glibc | 2.34-125.el9_5.1+sp999 |
| ubuntu 14.04-ESM | eglibc | 2.19-0ubuntu6.15+esm1 |
| ubuntu 16.04 | glibc | 2.23-0ubuntu11.2 |
| ubuntu 16.04-ESM | glibc | 2.23-0ubuntu11.2 |
References
- http://bugs.debian.org/878159
- http://www.securityfocus.com/bid/102912
- https://access.redhat.com/errata/RHBA-2019:0327
- https://access.redhat.com/errata/RHSA-2018:3092
- https://access.redhat.com/security/cve/CVE-2018-6485
- https://linux.oracle.com/cve/CVE-2018-6485.html
- https://linux.oracle.com/errata/ELSA-2018-3092.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-6485
All 16 references
- https://security.netapp.com/advisory/ntap-20190404-0003/
- https://sourceware.org/bugzilla/show_bug.cgi?id=22343
- https://ubuntu.com/security/notices/USN-4218-1
- https://ubuntu.com/security/notices/USN-4416-1
- https://usn.ubuntu.com/4218-1/
- https://usn.ubuntu.com/4416-1/
- https://www.cve.org/CVERecord?id=CVE-2018-6485
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html