writeup_split

Abstract CVE-2024-0684 A vulnerability in the GNU coreutils "split" program allows for a heap buffer overflow with user controlled data. It was introduced in 40bf1591bb4362fa91e501bcec7c2029c5f65a43 on 2023-03-04. A fix has been released with c4c5ed8f4e9cd55a12966d4f520e3a13101637d9 on 2024-01-17...

Security Bulletin: IBM DataPower Gateway affected by denial of service due to Coreutils (CVE-2025-5278)

Summary CVE-2025-5278 addressed in IBM DataPower Gateway version 11.0.0.3 Vulnerability Details CVEID:CVE-2025-5278 DESCRIPTION: A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated...

Unity Linux 20.1070a Security Update: coreutils (UTSA-2026-123926)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-123926 advisory. A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the allocate...

CVE-2026-93658

A flaw was found in uutils coreutils. When installing files, the software applies setuid or setgid permissions before finalizing ownership changes. This can allow a privileged user to inadvertently leave behind executable files with elevated privileges if the ownership change operation fails on...

coreutils security update

An update is available for coreutils. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The coreutils packages contain the GNU Core Utilities and represent a...

RLSA-2026:69964 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

coreutils security update

8.30-21.0.1 - clean up empty file if cp is failed Orabug 15973168 - df --local: recognize afs, auristorfs, and smb3 as remote fs 1798030 - fix formatting of sha512sum1 man page 1688744 8.30-21 - sort: fix buffer under-read CVE-2025-5278 RHEL-216927...

coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification

A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitiv...

Moderate: Red Hat Security Advisory: coreutils security update

An update for coreutils is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

AlmaLinux 8 : coreutils (ALSA-2026:69964)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69964 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly from th...

Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

RHEL 8 : coreutils (RHSA-2026:69964)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69964 advisory. The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils...

ALSA-2026:69964 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 For more details about the security...

Linux Distros Unpatched Vulnerability : CVE-2026-93658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to...

DEBIAN-CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

UBUNTU-CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-93658

uutils coreutils versions from 0.0.18 before 0.10.0 contain a privilege escalation vulnerability in the install command. The root cause is that setuid or setgid mode is applied to the install destination before ownership changes are finalized. On capability-restricted systems , if the ownership c...

CVE-2026-93658 uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...