Gnu Coreutils vulnerabilities

CVE-2003-0853 [MEDIUM] CVE-2003-0853: An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a la An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.

CVE-2014-9471 [HIGH] CVE-2014-9471: The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (c The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

CVE-2015-4042 [CRITICAL] CWE-190 CVE-2015-4042: Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

CVE-2015-4041 [HIGH] CWE-787 CVE-2015-4041: The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms perfo The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-

CVE-2003-0854 [LOW] CVE-2003-0854: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.

CVE-2017-18018 [HIGH] CWE-362 CVE-2017-18018: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a pla In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

CVE-2026-56391 [MEDIUM] CWE-125 CVE-2026-56391: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte inp GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect

CVE-2015-1865 [MEDIUM] CWE-362 CVE-2015-1865: fts.c in coreutils 8.4 allows local users to delete arbitrary files. fts.c in coreutils 8.4 allows local users to delete arbitrary files.

CVE-2007-4998 [MEDIUM] CVE-2007-4998: cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlin cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.

CVE-2024-0684 [MEDIUM] CWE-122 CVE-2024-0684: A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.

CVE-2017-2616 [MEDIUM] CVE-2017-2616: A race condition was found in util-linux before 2 A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.

CVE-2009-4135 [MEDIUM] CWE-59 CVE-2009-4135: The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain pr The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.

CVE-2026-56392 [LOW] CWE-122 CVE-2026-56392: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow duri GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, le

CVE-2008-1946 [MEDIUM] CWE-264 CVE-2008-1946: The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain t The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module.

CVE-2016-2781 [MEDIUM] CVE-2016-2781: chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

CVE-2005-1039 [LOW] CVE-2005-1039: Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is runn Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify permissions of other files.