Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Coreutils: heap buffer under-read in gnu coreutils sort via key specification (coreutils)

CVE-2025-5278
MEDIUM 4.4

At a glance

Source
NVD
EPSS
EPSS 0.31 % · percentile 24 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Search on…

Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Weaknesses (CWE)

  • CWE-121 — Stack-based Buffer Overflow

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Lredhat
CVSS 3.1MEDIUM 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:LNVD · secalert@redhat.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
coreutilsaffected 7.2 < 9.8
Red Hat · Red Hat Enterprise Linux 10unaffected 0:9.5-8.el10_2 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.30-21.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:8.32-41.el9_8 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791371080 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791371069 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791788287 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791970484 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459707 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459711 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459759 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1789029076 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791966259 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.20unaffected 1790598593 < *
Red Hat · Cost Management 4unaffected 1783539156 < *
Red Hat · Red Hat Discovery 2unaffected 1782756541 < *
Red Hat · Red Hat Discovery 2unaffected 1784821670 < *
Red Hat · Red Hat Insights proxy 1.5unaffected 1782890503 < *
Red Hat · Red Hat OpenShift distributed tracing 3.10.1unaffected 1782501180 < *
Red Hat · Red Hat OpenShift distributed tracing 3.10.1unaffected 1782501200 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD