CVE-2018-6551
glibc: integer overflow in malloc functions
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Amazon (medium).
Description
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | glibc | 2.22-19.ph1 |
| Photon OS 2.0 | glibc | 2.26-10.ph2 |
| amazon linux 2 | glibc, glibc-all-langpacks, glibc-benchtests and 198 more | 2.26-27.amzn2.0.4 |
| debian 11 | glibc | 2.27-1 |
| debian 12 | glibc | 2.27-1 |
| debian 13 | glibc | 2.27-1 |
| debian 14 | glibc | 2.27-1 |
| echo | glibc | 2.27-1 |
| root.io debian 11 | rootio-glibc | 2.27-1 |
| root.io debian 12 | rootio-glibc | 2.27-1 |
| root.io debian 13 | rootio-glibc | 2.27-1 |
Show all 211 entries from 11 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | glibc | 2.22-19.ph1 |
| Photon OS 2.0 | glibc | 2.26-10.ph2 |
| amazon linux 2 | glibc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-all-langpacks | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-benchtests | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-common | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-debuginfo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-debuginfo-common | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-devel | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-headers | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-aa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-af | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ak | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-am | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-an | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-anp | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ar | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-as | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ast | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ayc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-az | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-be | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bem | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ber | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bhb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bho | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-br | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-brx | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-bs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-byn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ca | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ce | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-chr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cmn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-crh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-csb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-cy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-da | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-de | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-doi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-dv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-dz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-el | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-en | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-eo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-es | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-et | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-eu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ff | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fil | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fur | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-fy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ga | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gez | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-gv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ha | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hak | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-he | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hne | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hsb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ht | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-hy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ia | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-id | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ig | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ik | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-is | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-it | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-iu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ja | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ka | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-km | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ko | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kok | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ks | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ku | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-kw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ky | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-li | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lij | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ln | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-lzh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mag | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mai | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mhr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ml | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mni | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ms | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-mt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-my | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nan | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nb | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nds | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ne | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nhn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-niu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-nso | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-oc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-om | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-or | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-os | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pap | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ps | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-pt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-quz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-raj | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ro | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ru | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-rw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sat | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sc | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-se | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sgs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-shs | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-si | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sid | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-so | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sq | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ss | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-st | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sv | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-sw | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-szl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ta | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tcy | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-te | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tg | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-th | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-the | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ti | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tig | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tl | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tn | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tr | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ts | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-tt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ug | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-uk | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-unm | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ur | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-uz | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-ve | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-vi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wa | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wae | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wal | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-wo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-xh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yi | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yo | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-yue | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-zh | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-langpack-zu | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-locale-source | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-minimal-langpack | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-nss-devel | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-static | 2.26-27.amzn2.0.4 |
| amazon linux 2 | glibc-utils | 2.26-27.amzn2.0.4 |
| amazon linux 2 | libcrypt | 2.26-27.amzn2.0.4 |
| amazon linux 2 | libcrypt-nss | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nscd | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_db | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_hesiod | 2.26-27.amzn2.0.4 |
| amazon linux 2 | nss_nis | 2.26-27.amzn2.0.4 |
| debian 11 | glibc | 2.27-1 |
| debian 12 | glibc | 2.27-1 |
| debian 13 | glibc | 2.27-1 |
| debian 14 | glibc | 2.27-1 |
| echo | glibc | 2.27-1 |
| root.io debian 11 | rootio-glibc | 2.27-1 |
| root.io debian 12 | rootio-glibc | 2.27-1 |
| root.io debian 13 | rootio-glibc | 2.27-1 |
References
- https://access.redhat.com/security/cve/CVE-2018-6551
- https://nvd.nist.gov/vuln/detail/CVE-2018-6551
- https://security.netapp.com/advisory/ntap-20190404-0003/
- https://sourceware.org/bugzilla/show_bug.cgi?id=22774
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=8e448310d74b283c5cd02b9ed7fb997b47bf9b22
- https://www.cve.org/CVERecord?id=CVE-2018-6551