CVE-2018-6485: Integer Overflow
A flaw was found in glibc. An integer overflow in the implementation of the posixmemalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
References: https://sourceware.org/bugzilla/showbug.cgi?id=22343
Patch: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8e448310d74b283c5cd02b9ed7fb997b47bf9b22
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.36-9+deb12u7Fixed in 2.41-12+deb13u3Fixed in 2.42-17
Event History
Frequently Asked Questions
What is CVE-2018-6485?
CVE-2018-6485 is an integer overflow vulnerability in the GNU C Library (glibc) that could potentially lead to heap corruption.
How severe is CVE-2018-6485?
CVE-2018-6485 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2018-6485?
Versions 2.26 and earlier of the GNU C Library (glibc) are affected by CVE-2018-6485.
What is the remedy for CVE-2018-6485?
To remedy CVE-2018-6485, update to version 2.28-10+deb10u1 or later for Debian, or 2.19-0ubuntu6.15+ for Ubuntu.
Where can I find more information about CVE-2018-6485?
You can find more information about CVE-2018-6485 in the Debian bug report, the Sourceware bugzilla, and the SecurityFocus vulnerability database.