Summary
[9.5-8.0.1.el10_2.1]
- clean up empty file if cp is failed [Orabug 15973168]
[9.5-8.1]
- uniq: fix CVE-2026-56391 (RHEL-216794)
- fix read overrun with -w
- unexpand: fix CVE-2026-56392 and related crashes (RHEL-216784)
- fix direct.sh and unexpand/mb.sh tests
- fix unexpand/expand crash on invalid multibyte characters
- fix heap overflow with large tab stops
- fix heap overflow when a wide blank overshoots a tab stop
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | coreutils | 0:9.5-8.0.1.el10_2.1 |
| Oracle Linux · 10 | coreutils-common | 0:9.5-8.0.1.el10_2.1 |
| Oracle Linux · 10 | coreutils-single | 0:9.5-8.0.1.el10_2.1 |
Vulnerabilities 2
-
Medium 4.6
Out‑of‑bounds Read in GNU coreutils
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer i…
-
Low 1.8
Heap-based Buffer Overflow in GNU coreutils
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an unde…