SB2017120515 - Integer overflow in GNU Glibc
Published: December 5, 2017 Updated: August 8, 2020
Security Bulletin ID
SB2017120515
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Integer overflow (CVE-ID: CVE-2017-17426)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Remediation
Install update from vendor's website.