CVE-2018-11236 Integer overflow in n/a

Critical 9.8 Published 18 May 2018 Updated 5 Aug 2024

An integer overflow in glibc's realpath function on 32-bit systems can lead to a stack-based buffer overflow, potentially allowing arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-11236?

CVE-2018-11236 is a critical vulnerability in Gnu Glibc, published on 18 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2018-11236?

It affects 9 products.

Linux distribution packages (6)

`glibc` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2.11.3-17.110.14.1`
`glibc` SUSE:Linux Enterprise Server 11 SP3-LTSS	All versions	`2.11.3-17.110.14.1`
`glibc` SUSE:Linux Enterprise Server 11 SP3-TERADATA	All versions	`2.11.3-17.110.14.1`
`glibc` SUSE:Linux Enterprise Server 11 SP4	All versions	`2.11.3-17.110.14.1`
`glibc` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`2.11.3-17.110.14.1`
`glibc` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`2.11.3-17.110.14.1`

Products include Gnu Glibc, Netapp Data Ontap Edge, Netapp Element Software Management, Oracle Communications Session Border Controller, Oracle Enterprise Communications Broker, Redhat Enterprise Linux Desktop and 3 more.

How do I fix CVE-2018-11236?

Apply the vendor's patch.

Is CVE-2018-11236 being exploited?

There is no known exploitation of CVE-2018-11236 in the wild and no public exploit code.

All Gnu Glibc vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-11236, GHSA-pgv4-4294-ccrq, SUSE-SU-2018:2302-1, UBUNTU-CVE-2018-11236.