6 results · Clear filters · Feed
-
Low 3.3
uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling
A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the…
-
Low 3.3
uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions
A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuitin…
-
Low 3.3
uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode
A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \\ and \').…
-
Low 3.3
uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding
A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrite…
-
Low 3.3
uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user e…
-
Low 3.3
uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides …