Coreutils (Uutils) - vulnerabilities (CVEs)

45 CVEs, 0 in the last 30 days, 41 known versions, newest CVE from 2026-09-18. Vendor: Uutils.

CVEs of Coreutils

CVE-2026-93658 - CVSS 7.3 (high), 2026-09-18: uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to…
CVE-2026-35381 - CVSS 3.3 (low), 2026-04-22: A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d ''…
CVE-2026-35380 - CVSS 5.5 (medium), 2026-04-22: A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an…
CVE-2026-35374 - CVSS 6.3 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking…
CVE-2026-35377 - CVSS 3.3 (low), 2026-04-22: A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option.…
CVE-2026-35376 - CVSS 5.8 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves…
CVE-2026-35379 - CVSS 3.3 (low), 2026-04-22: A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation…
CVE-2026-35375 - CVSS 3.3 (low), 2026-04-22: A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The…
CVE-2026-35378 - CVSS 3.3 (low), 2026-04-22: A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the…
CVE-2026-35373 - CVSS 5.5 (medium), 2026-04-22: A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory…
CVE-2026-35372 - CVSS 5 (medium), 2026-04-22: A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is…
CVE-2026-35368 - CVSS 7.8 (high), 2026-04-22: A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam()…
CVE-2026-35371 - CVSS 3.3 (low), 2026-04-22: The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation…
CVE-2026-35367 - CVSS 3.3 (low), 2026-04-22: The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to…
CVE-2026-35370 - CVSS 4.4 (medium), 2026-04-22: The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID…
CVE-2026-35366 - CVSS 4.4 (medium), 2026-04-22: The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes…
CVE-2026-35369 - CVSS 5.5 (medium), 2026-04-22: An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1.…
CVE-2026-35365 - CVSS 6.6 (medium), 2026-04-22: The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of…
CVE-2026-35364 - CVSS 6.3 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the…
CVE-2026-35363 - CVSS 5.6 (medium), 2026-04-22: A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility…
CVE-2026-35358 - CVSS 5.5 (medium), 2026-04-22: The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than…
CVE-2026-35361 - CVSS 4.4 (medium), 2026-04-22: The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling…
CVE-2026-35357 - CVSS 4.7 (medium), 2026-04-22: The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived…
CVE-2026-35360 - CVSS 6.3 (medium), 2026-04-22: The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility…
CVE-2026-35356 - CVSS 6.3 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent…
CVE-2026-35359 - CVSS 4.7 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility…
CVE-2026-35362 - CVSS 3.6 (low), 2026-04-22: The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using…
CVE-2026-35349 - CVSS 7.7 (high), 2026-04-22: A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather…
CVE-2026-35352 - CVSS 7 (high), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a…
CVE-2026-35355 - CVSS 6.3 (medium), 2026-04-22: The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation…
CVE-2026-35348 - CVSS 5.5 (medium), 2026-04-22: The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The…
CVE-2026-35351 - CVSS 4.2 (medium), 2026-04-22: The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a…
CVE-2026-35354 - CVSS 4.7 (medium), 2026-04-22: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr)…
CVE-2026-35350 - CVSS 6.6 (medium), 2026-04-22: The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve)…
CVE-2026-35353 - CVSS 3.3 (low), 2026-04-22: The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically…
CVE-2026-35342 - CVSS 3.3 (low), 2026-04-22: The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR…
CVE-2026-35345 - CVSS 5.3 (medium), 2026-04-22: A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU…
CVE-2026-35341 - CVSS 7.1 (high), 2026-04-22: A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO…
CVE-2026-35344 - CVSS 3.3 (low), 2026-04-22: The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While…
CVE-2026-35347 - CVSS 4.4 (medium), 2026-04-22: The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical…
CVE-2026-35343 - CVSS 3.3 (low), 2026-04-22: The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The…
CVE-2026-35346 - CVSS 3.3 (low), 2026-04-22: The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses…
CVE-2026-35339 - CVSS 5.5 (medium), 2026-04-22: The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is…
CVE-2026-35338 - CVSS 7.3 (high), 2026-04-22: A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the…
CVE-2026-35340 - CVSS 5.5 (medium), 2026-04-22: A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The…