A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
Se encontró una falla en el programa "split" de GNU coreutils. Podría producirse un desbordamiento de almacenamiento dinámico con datos controlados por el usuario de varios cientos de bytes de longitud en la función line_bytes_split(), lo que podría provocar un bloqueo de la aplicación y una denegación de servicio.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-122
|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | coreutils | 9.2 | <built-in method update of dict object at 0x7fd340a53d00> | Application |
| gnu | coreutils | 9.3 | <built-in method update of dict object at 0x7fd2dbc09740> | Application |
| gnu | coreutils | 9.4 | <built-in method update of dict object at 0x7fd360692640> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:coreutils:9.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:gnu:coreutils:9.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:gnu:coreutils:9.4:*:*:*:*:*:*:* |