CVE-2018-1000001

Description

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

Weakness classification

• nvd@nist.gov: CWE-787

Primary references

• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry