7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
77.0%
Severity: High
Date : 2018-01-28
CVE-ID : CVE-2018-1000001
Package : lib32-glibc
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-590
The package lib32-glibc before version 2.26-11 is vulnerable to
privilege escalation.
Upgrade to 2.26-11.
The problem has been fixed upstream but no release is available yet.
None.
A buffer underflow vulnerability has been discovered in the realpath()
function in glibc 2.26 when getcwd() returns a relative or unreachable
path (i.e. not starting with β/β) which may allow privilege escalation
under certain conditions.
A local attacker is able to escalate privileges on the affected host.
http://www.openwall.com/lists/oss-security/2018/01/11/5
https://sourceware.org/bugzilla/show_bug.cgi?id=22679
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52a713fdd0a30e1bd79818e2e3c4ab44ddca1a94
https://security.archlinux.org/CVE-2018-1000001
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | lib32-glibc | <Β 2.26-11 | UNKNOWN |
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
77.0%