CVE-2018-11237
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
- Score
- CVSS 3.1 7.8 High
- Status
- Modified - cve@mitre.org
- Published
- 2018-05-18
- Last modified
- 2024-08-05
- Weaknesses
- CWE-787
Affected products
- Ubuntu Linux (Canonical)
- Glibc (Gnu)
- Data Ontap Edge (Netapp)
- Element Software Management (Netapp)
- Communications Session Border Controller (Oracle)
- Enterprise Communications Broker (Oracle)
- Enterprise Linux Desktop (Redhat)
- Enterprise Linux Server (Redhat)
- Enterprise Linux Workstation (Redhat)
- Virtualization Host (Redhat)
References
- http://www.securityfocus.com/bid/104256
- https://access.redhat.com/errata/RHBA-2019:0327
- https://access.redhat.com/errata/RHSA-2018:3092
- https://security.netapp.com/advisory/ntap-20190329-0001/
- https://security.netapp.com/advisory/ntap-20190401-0001/
- https://sourceware.org/bugzilla/show_bug.cgi?id=23196
- https://usn.ubuntu.com/4416-1/
- https://www.exploit-db.com/exploits/44750/
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
