This update for glibc fixes the following issues: Security issues fixed :

  - CVE-2017-8804: Fix memory leak after deserialization     failure in xdr_bytes, xdr_string (bsc#1037930)

  - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes     (bsc#1051791)

  - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in     internal memalign and malloc functions (bsc#1079036)

  - CVE-2018-1000001: Avoid underflow of malloced area     (bsc#1074293) Non security bugs fixed :

  - Release read lock after resetting timeout (bsc#1073990)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries (CVE-2017-16997)

* glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

* glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow (CVE-2018-11236)

* glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Security Fix(es) :

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can     be used to execute code loaded from arbitrary libraries     (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign     functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on     32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper     (CVE-2018-11237)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3092 advisory.

    - CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
    - CVE-2018-11237: AVX-512 mempcpy for KNL buffer overflow (#1579809)
    - CVE-2018-11236: Path length overflow in realpath (#1579742)
    - CVE-2018-6485: Integer overflow in posix_memalign in memalign (#1548002)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

Security issues fixed :

  - CVE-2017-8804: Fix memory leak after deserialization     failure in xdr_bytes, xdr_string (bsc#1037930)

  - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes     (bsc#1051791)

  - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in     internal memalign and malloc functions (bsc#1079036)

  - CVE-2018-1000001: Avoid underflow of malloced area     (bsc#1074293)

Non security bugs fixed :

  - Release read lock after resetting timeout (bsc#1073990)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3092 advisory.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3623:01 advisory.

    * glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)
      * glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)
      * glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)
      * glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

This update fixes two minor security vulnerabilities in `malloc` (CVE-2018-6485, CVE-2018-6551, RHBZ#1542102, RHBZ#1542119), and provides a C++ version of `iseqsig`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in malloc functions :

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption. (CVE-2018-6551)

Integer overflow in posix_memalign in memalign functions :

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
(CVE-2018-6485)

A buffer overflow has been discovered in the GNU C Library (aka glibc or libc6) in the __mempcpy_avx512_no_vzeroupper function when particular conditions are met. An attacker could use this vulnerability to cause a denial of service or potentially execute code.(CVE-2018-11237)

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions.
This is associated with misinterpretion of an empty RPATH/RUNPATH token as the './' directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.(CVE-2017-16997)

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.(CVE-2018-11236)

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.(CVE-2018-6485)

ID	名稱	產品	系列	已發布	已更新	嚴重性
106865	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0451-1)	Nessus	SuSE Local Security Checks	2018/2/16	2025/10/29	critical
122172	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1025)	Nessus	Huawei Local Security Checks	2019/2/14	2024/6/20	critical
118992	CentOS 7 : glibc (CESA-2018:3092)	Nessus	CentOS Local Security Checks	2018/11/16	2022/5/27	critical
119182	Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	critical
180807	Oracle Linux 7 : glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
106916	openSUSE Security Update : glibc (openSUSE-2018-184)	Nessus	SuSE Local Security Checks	2018/2/21	2025/10/29	critical
122377	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-1050)	Nessus	Huawei Local Security Checks	2019/2/22	2024/6/18	critical
118527	RHEL 7 : glibc (RHSA-2018:3092)	Nessus	Red Hat Local Security Checks	2018/10/31	2024/4/27	critical
288990	MiracleLinux 7 : glibc-2.17-260.el7 (AXSA:2019-3623:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
121924	Photon OS 2.0: Glibc PHSA-2018-2.0-0020	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	critical
107158	Fedora 27 : glibc (2018-1cbdc8cbb8)	Nessus	Fedora Local Security Checks	2018/3/7	2025/10/27	critical
109141	Amazon Linux 2 : glibc (ALAS-2018-992)	Nessus	Amazon Linux Local Security Checks	2018/4/18	2024/10/30	critical
119468	Amazon Linux AMI : glibc (ALAS-2018-1109)	Nessus	Amazon Linux Local Security Checks	2018/12/7	2024/7/17	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical