| 0 |
| url |
VCID-1e7v-b871-v3dv |
| vulnerability_id |
VCID-1e7v-b871-v3dv |
| summary |
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2016-2781
|
| risk_score |
3.9 |
| exploitability |
0.5 |
| weighted_severity |
7.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1e7v-b871-v3dv |
|
| 1 |
| url |
VCID-3553-2uat-byg2 |
| vulnerability_id |
VCID-3553-2uat-byg2 |
| summary |
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2013-0223
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3553-2uat-byg2 |
|
| 2 |
| url |
VCID-4phm-xps4-xygm |
| vulnerability_id |
VCID-4phm-xps4-xygm |
| summary |
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2013-0221
|
| risk_score |
0.2 |
| exploitability |
2.0 |
| weighted_severity |
0.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4phm-xps4-xygm |
|
| 3 |
|
| 4 |
|
| 5 |
| url |
VCID-etyt-c12h-4qet |
| vulnerability_id |
VCID-etyt-c12h-4qet |
| summary |
The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-1946
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-etyt-c12h-4qet |
|
| 6 |
| url |
VCID-evqz-xzkw-u3e7 |
| vulnerability_id |
VCID-evqz-xzkw-u3e7 |
| summary |
The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2015-4041
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-evqz-xzkw-u3e7 |
|
| 7 |
|
| 8 |
| url |
VCID-fymz-k4pt-5ugu |
| vulnerability_id |
VCID-fymz-k4pt-5ugu |
| summary |
Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify permissions of other files. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2005-1039
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fymz-k4pt-5ugu |
|
| 9 |
|
| 10 |
| url |
VCID-mk1u-axz2-e3hf |
| vulnerability_id |
VCID-mk1u-axz2-e3hf |
| summary |
cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-4998
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mk1u-axz2-e3hf |
|
| 11 |
| url |
VCID-mrxc-djq9-wkdg |
| vulnerability_id |
VCID-mrxc-djq9-wkdg |
| summary |
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
|
| aliases |
(+, CVE-2017-2616, fix), regression
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mrxc-djq9-wkdg |
|
| 12 |
| url |
VCID-sbbr-jj5q-p7et |
| vulnerability_id |
VCID-sbbr-jj5q-p7et |
| summary |
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2013-0222
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sbbr-jj5q-p7et |
|
| 13 |
| url |
VCID-suu6-5d7s-nyha |
| vulnerability_id |
VCID-suu6-5d7s-nyha |
| summary |
An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2003-0853
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-suu6-5d7s-nyha |
|
| 14 |
| url |
VCID-ujkw-6mdt-5yh5 |
| vulnerability_id |
VCID-ujkw-6mdt-5yh5 |
| summary |
Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2015-4042
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ujkw-6mdt-5yh5 |
|
| 15 |
| url |
VCID-vxmp-ea3f-vudb |
| vulnerability_id |
VCID-vxmp-ea3f-vudb |
| summary |
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2003-0854
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vxmp-ea3f-vudb |
|