CVE-2018-6551 Integer overflow in n/a

Critical 9.8 Published 2 Feb 2018 Updated 5 Aug 2024

An integer overflow in glibc malloc can cause heap corruption, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-6551?

CVE-2018-6551 is a critical vulnerability in Gnu Glibc, published on 2 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2018-6551?

It affects 1 product.

Products include Gnu Glibc.

How do I fix CVE-2018-6551?

Upgrade to a fixed version.

Is CVE-2018-6551 being exploited?

There is no known exploitation of CVE-2018-6551 in the wild and no public exploit code.

All Gnu Glibc vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-6551, GHSA-39wv-6252-46w2.