{"id":"CVE-2018-11237","aliases":["DEBIAN-CVE-2018-11237","EUVD-2018-3277","GHSA-fh43-5v3x-c3vr","RHSA-2018:3092","SUSE-SU-2018:1562-1","SUSE-SU-2018:1562-2","SUSE-SU-2018:1991-1","UBUNTU-CVE-2018-11237","USN-4416-1","openSUSE-SU-2024:10792-1"],"status":"published","title":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or...","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00874,"percentile":0.59168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-05-18T16:00:00Z","modified":"2026-10-24T10:30:15Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.27-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.27-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.27-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"glibc","fixed_in":["2.23-0ubuntu11.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"glibc","fixed_in":["2.27-3ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-260.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-62.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-13.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-13.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-0ubuntu11.2"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-3ubuntu1.2"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-0ubuntu11.2"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-3ubuntu1.2"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-1.2"}]}],"bundled":34}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnu","product":"glibc"},{"vendor":"netapp","product":"data_ontap_edge"},{"vendor":"netapp","product":"element_software_management"},{"vendor":"oracle","product":"communications_session_border_controller"},{"vendor":"oracle","product":"enterprise_communications_broker"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"virtualization_host"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=23196","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/44750/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/104256","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3092","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190329-0001/","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190401-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4416-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11237","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fh43-5v3x-c3vr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11237","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1349967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1349982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1408964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1526865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1531168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1542102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581274","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3092.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-16997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16997","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6485","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11237","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11237","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181562-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086690","tags":["report"]},{"url":"https://bugzilla.suse.com/1094150","tags":["report"]},{"url":"https://bugzilla.suse.com/1094154","tags":["report"]},{"url":"https://bugzilla.suse.com/1094161","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11237","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181562-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181991-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1092877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11237","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4416-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10029","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33574","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-11237","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:00:00Z","modified":"2024-08-05T08:01:52.813Z","updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-3277","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:00:00Z","modified":"2024-08-05T08:01:52Z","updated_at":"2026-11-03T02:39:56.043234Z"}],"ghsa":[{"id":"GHSA-fh43-5v3x-c3vr","title":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or...","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2022-05-13T01:18:53Z","modified":"2023-01-31T05:07:29Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:49:13.084976Z"}],"nvd":[{"id":"CVE-2018-11237","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:29:00.417Z","modified":"2026-06-17T01:35:33.483Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11237","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:29:00.417Z","modified":"2026-10-24T10:30:15.900307673Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-11237","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:29:00.417Z","modified":"2026-10-23T18:03:18.689958207Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:3092","title":"Red Hat Security Advisory: glibc security, bug fix, and enhancement update","status":"published","published":"2024-09-16T01:21:02Z","modified":"2026-06-27T10:06:16Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-11237","description":"An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.","status":"published","published":"2018-05-18T16:29:00Z","modified":"2026-04-22T11:42:04.560973Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2024:10792-1","title":"glibc-2.34-1.2 on GA media","description":"These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:58.912445Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:1562-1","title":"Security update for glibc","description":"\n  \nThis update for glibc fixes the following issues:\n\n- CVE-2017-18269: Fix SSE2 memmove issue when crossing 2GB boundary (bsc#1094150)\n- CVE-2018-11236: Fix overflow in path length computation (bsc#1094161)\n- CVE-2018-11237: Don't write beyond buffer destination in __mempcpy_avx512_no_vzeroupper (bsc#1094154)\n\nNon security bugs fixed:\n\n- Fix crash in resolver on memory allocation failure (bsc#1086690)\n\n","status":"published","published":"2018-06-06T09:44:49Z","modified":"2026-02-04T02:32:37.350576Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1562-2","title":"Security update for glibc","description":"\n  \nThis update for glibc fixes the following issues:\n\n- CVE-2017-18269: Fix SSE2 memmove issue when crossing 2GB boundary (bsc#1094150)\n- CVE-2018-11236: Fix overflow in path length computation (bsc#1094161)\n- CVE-2018-11237: Don't write beyond buffer destination in __mempcpy_avx512_no_vzeroupper (bsc#1094154)\n\nNon security bugs fixed:\n\n- Fix crash in resolver on memory allocation failure (bsc#1086690)\n\n","status":"published","published":"2018-10-18T12:46:04Z","modified":"2026-02-04T02:38:55.586502Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1991-1","title":"Security update for glibc","description":"This update for glibc fixes the following security issues:\n\n- CVE-2017-18269: An SSE2-optimized memmove implementation for i386 did not\n  correctly perform the overlapping memory check if the source memory range\n  spaned the middle of the address space, resulting in corrupt data being\n  produced by the copy operation. This may have disclosed information to\n  context-dependent attackers, resulted in a denial of service or code execution\n  (bsc#1094150).\n- CVE-2018-11236: Prevent integer overflow on 32-bit architectures when\n  processing very long pathname arguments to the realpath function, leading to a\n  stack-based buffer overflow (bsc#1094161).\n- CVE-2018-11237: An AVX-512-optimized implementation of the mempcpy function\n  may have writen data beyond the target buffer, leading to a buffer overflow in\n  __mempcpy_avx512_no_vzeroupper (bsc#1092877, bsc#1094154).\n  ","status":"published","published":"2018-07-19T07:25:13Z","modified":"2026-02-04T04:13:35.81593Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-4416-1","title":"glibc vulnerabilities","description":"Florian Weimer discovered that the GNU C Library incorrectly handled\ncertain memory operations. A remote attacker could use this issue to cause\nthe GNU C Library to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2017-12133)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nSSE2-optimized memmove operations. A remote attacker could use this issue\nto cause the GNU C Library to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2017-18269)\n\nIt was discovered that the GNU C Library incorrectly handled certain\npathname operations. A remote attacker could use this issue to cause the\nGNU C Library to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-11236)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nAVX-512-optimized mempcpy operations. A remote attacker could use this\nissue to cause the GNU C Library to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2018-11237)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nhostname loookups. A remote attacker could use this issue to cause the GNU\nC Library to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19591)\n\nJakub Wilk discovered that the GNU C Library incorrectly handled certain\nmemalign functions. A remote attacker could use this issue to cause the GNU\nC Library to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-6485)\n\nIt was discovered that the GNU C Library incorrectly ignored the\nLD_PREFER_MAP_32BIT_EXEC environment variable after security transitions. A\nlocal attacker could use this issue to bypass ASLR restrictions.\n(CVE-2019-19126)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nregular expressions. A remote attacker could possibly use this issue to\ncause the GNU C Library to crash, resulting in a denial of service. This\nissue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9169)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nbit patterns. A remote attacker could use this issue to cause the GNU C\nLibrary to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2020-10029)\n\nIt was discovered that the GNU C Library incorrectly handled certain\nsignal trampolines on PowerPC. A remote attacker could use this issue to\ncause the GNU C Library to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2020-1751)\n\nIt was discovered that the GNU C Library incorrectly handled tilde\nexpansion. A remote attacker could use this issue to cause the GNU C\nLibrary to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2020-1752)\n","status":"published","published":"2020-07-06T18:10:11Z","modified":"2026-04-27T19:02:50.923199887Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}