CVE-2017-18269

Name	CVE-2017-18269
Description	An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	buster	2.28-10+deb10u1	fixed
	buster (security)	2.28-10+deb10u2	fixed
	bullseye	2.31-13+deb11u8	fixed
	bullseye (security)	2.31-13+deb11u9	fixed
	bookworm	2.36-9+deb12u4	fixed
	bookworm (security)	2.36-9+deb12u6	fixed
	sid, trixie	2.37-18	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
eglibc	source	(unstable)	(not affected)
glibc	source	jessie	(not affected)
glibc	source	stretch	2.24-11+deb9u4
glibc	source	(unstable)	2.27-3

Notes

[jessie] - glibc <not-affected> (Vulnerable code not present)
- eglibc <not-affected> (Vulnerable code not present)
https://sourceware.org/bugzilla/show_bug.cgi?id=22644
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=cd66c0e584c6d692bc8347b5e72723d02b8a8ada