Published: 06/02/2024 Updated: 14/02/2024

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 0

A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu coreutils 9.2
gnu coreutils 9.3
gnu coreutils 9.4

Debian Bug report logs - #1061138 coreutils: CVE-2024-0684: heap overflow in split --line-bytes with very long lines Package: src:coreutils; Maintainer for src:coreutils is Michael Stone <mstone@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 19 Jan 2024 05:21:01 UTC Severity: grave Tags ...

DescriptionA flaw was found in the GNU coreutils &quot;split&quot; program A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of serviceA flaw was found in the GNU coreutils "split" program A heap overf ...

oss-sec mailing list archives   By Date By Thread </form>    Re: GNU coreutils v94; v93; v92 split heap buffer overflow vulnerability  <!--X-Head-of-Message- ...

Writeup of a heap overflow vulnerability in the GNU coreutils split program. CVE-2024-0684

Abstract CVE-2024-0684 A vulnerability in the GNU coreutils "split" program allows for a heap buffer overflow with user controlled data It was introduced in 40bf1591bb4362fa91e501bcec7c2029c5f65a43 on 2023-03-04 A fix has been released with c4c5ed8f4e9cd55a12966d4f520e3a13101637d9 on 2024-01-17 Affected versions: GNU coreutils v94; v93; v92 Proof of concept: The

CWE-787 https://access.redhat.com/security/cve/CVE-2024-0684 https://bugzilla.redhat.com/show_bug.cgi?id=2258948 https://www.openwall.com/lists/oss-security/2024/01/18/2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061138 https://nvd.nist.gov https://github.com/Valentin-Metz/writeup_split https://access.redhat.com/security/cve/cve-2024-0684

CVE-2024-0684

Vulnerability Summary

Vendor Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect