CVE-2024-0684
Assigner: fedora
Published: 2024-02-06T08:26:58.770Z
State: PUBLISHED
title: Coreutils: heap overflow in split --line-bytes with very long lines
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
descriptions: value: A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
affected: versions: status: affected
version: v9.2
status: affected
version: v9.3
status: affected
version: v9.4
status: unaffected
version: v9.5
packageName: coreutils
collectionURL: https://git.savannah.gnu.org/gitweb/?p=coreutils.git
defaultStatus: unaffected
datePublic: 2024-01-18T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-122
description: Heap-based Buffer Overflow
type: CWE
x_redhatCweChain: CWE-122: Heap-based Buffer Overflow
workarounds: value: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2024-01-18T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-01-18T00:00:00+00:00
value: Made public.