Summary
It was discovered that GNU Core Utilities sort had a heap buffer under-read
in its begfield() function. A local attacker could possibly use this issue
to cause GNU Core Utilities to crash, resulting in a denial of service, or
obtain sensitive information. (CVE-2025-5278)
It was discovered that GNU Core Utilities uniq had an out-of-bounds read
when the -w option was used with crafted multibyte input. A local attacker
could possibly use this issue to cause GNU Core Utilities to crash,
resulting in a denial of service, or obtain sensitive information. This
issue only affected Ubuntu 26.04 LTS. (CVE-2026-56391)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | coreutils | 8.32-4.1ubuntu1.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | coreutils | 9.4-3ubuntu6.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | coreutils | 9.7-3ubuntu2.1 |
Vulnerabilities 2
-
Medium 4.6
Out‑of‑bounds Read in GNU coreutils
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer i…
-
Medium 4.4
Coreutils: heap buffer under-read in gnu coreutils sort via key specification
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious inpu…