GNU
GNU Coreutils: vulnerabilidades y CVE
GNU Coreutils tiene 13 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses2
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-56391 | Media (4.6) | 0.17% | — | 24 jul 2026 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by… |
| CVE-2026-56392 | Baja (1.8) | 0.19% | — | 24 jul 2026 | GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation… |
| CVE-2025-5278 | Media (4.4) | 0.29% | — | 27 may 2025 | A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the… |
| CVE-2024-0684 | Media (5.5) | 0.49% | — | 6 feb 2024 | A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application… |
| CVE-2015-4042 | Crítica (9.8) | 2.3% | — | 24 ene 2020 | Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long… |
| CVE-2015-4041 | Alta (7.8) | 0.52% | — | 24 ene 2020 | The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers… |
| CVE-2017-18018 | Alta (7.1) | 0.34% | — | 4 ene 2018 | In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of… |
| CVE-2015-1865 | Media (5.1) | 0.26% | — | 20 sept 2017 | fts.c in coreutils 8.4 allows local users to delete arbitrary files. |
| CVE-2016-2781 | Media (4.6) | 0.43% | — | 7 feb 2017 | chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. |
| CVE-2014-9471 | Alta (7.5) | 7.1% | — | 16 ene 2015 | The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1"… |
| CVE-2009-4135 | Media (4.4) | 0.38% | — | 11 dic 2009 | The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp. |
| CVE-2008-1946 | Media (4.4) | 0.31% | — | 28 jul 2008 | The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to… |
| CVE-2005-1039 | Baja (3.7) | 0.28% | — | 2 may 2005 | Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify permissions of other files. |