Coreutils (Gnu) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 73 known versions, newest CVE from 2026-07-24. Vendor: Gnu.
CVEs of Coreutils
- CVE-2026-56392 - CVSS 6.1 (medium), 2026-07-24: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t)…
- CVE-2026-56391 - CVSS 6.1 (medium), 2026-07-24: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The…
- CVE-2024-0684 - CVSS 5.5 (medium), 2024-02-06: A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the…
- CVE-2015-4042 - CVSS 9.8 (critical), 2020-01-24: Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application…
- CVE-2015-4041 - CVSS 7.8 (high), 2020-01-24: The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of…
- CVE-2017-18018 - CVSS 7.1 (high), 2018-01-04: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L"…
- CVE-2015-1865 - CVSS 5.1 (medium), 2017-09-20: fts.c in coreutils 8.4 allows local users to delete arbitrary files.
- CVE-2016-2781 - CVSS 6.5 (medium), 2017-02-07: chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes…
- CVE-2014-9471 - CVSS 7.5 (high), 2015-01-16: The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted…
- CVE-2009-4135 - CVSS 4.4 (medium), 2009-12-11: The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory…
- CVE-2008-1946 - CVSS 4.4 (medium), 2008-07-28: The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by…
- CVE-2005-1039 - CVSS 3.7 (low), 2005-05-02: Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify…
