CVE-2018-11236

Description

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Weakness classification

• CWE-190: Integer Overflow or Wraparound
• CWE-787: Out-of-bounds Write

Primary references

• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Broken Link
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Issue Tracking, Third Party Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory