Multiple vulnerabilities has been found and corrected in coreutils :

Long line inputs could trigger a segfault in the sort, uniq and join utilities (CVE-2013-0221, CVE-2013-0222, CVE-2013-0223).

The updated packages have been patched to correct these issues.

It was discovered that the sort, uniq, and join utilities did not properly restrict the use of the alloca() function. An attacker could use this flaw to crash those utilities by providing long input strings. (CVE-2013-0221, CVE-2013-0222, CVE-2013-0223)

This coreutils update fixes three minor security issues :

  - VUL-1: CVE-2013-0221: segmentation fault in 'sort -d'     and 'sort -M' with long line input. (bnc#798538)

  - VUL-1: CVE-2013-0222: segmentation fault in 'uniq' with     long line input. (bnc#796243)

  - VUL-1: CVE-2013-0223: segmentation fault in 'join -i'     with long line input (bnc#798541)

It was discovered that the sort, uniq, and join utilities did not properly restrict the use of the alloca() function. An attacker could use this flaw to crash those utilities by providing long input strings. (CVE-2013-0221 , CVE-2013-0222 , CVE-2013-0223)

- Avoid segmentation fault in 'join -i' with long line     input (bnc#798541, VUL-1, CVE-2013-0223)

  - Avoid segmentation fault in 'uniq' with long line input     (bnc#796243, VUL-1, CVE-2013-0222)

  - Avoid segmentation fault in 'sort -d' and 'sort -M' with     long line input (bnc#798538, VUL-1, CVE-2013-0221)

  - don't leak a file descriptor for each non-seekable input

Updated coreutils packages that fix three security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The coreutils package contains the core GNU utilities. It is a combination of the old GNU fileutils, sh-utils, and textutils packages.

It was discovered that the sort, uniq, and join utilities did not properly restrict the use of the alloca() function. An attacker could use this flaw to crash those utilities by providing long input strings. (CVE-2013-0221, CVE-2013-0222, CVE-2013-0223)

These updated coreutils packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All coreutils users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
66041	Mandriva Linux Security Advisory : coreutils (MDVSA-2013:023-1)	Nessus	Mandriva Local Security Checks	2013/4/20	2021/1/6	medium
71296	Scientific Linux Security Update : coreutils on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	2013/12/10	2021/1/14	medium
70134	SuSE 11.2 / 11.3 Security Update : coreutils (SAT Patch Numbers 8334 / 8336)	Nessus	SuSE Local Security Checks	2013/9/26	2021/1/19	medium
71401	Amazon Linux AMI : coreutils (ALAS-2013-261)	Nessus	Amazon Linux Local Security Checks	2013/12/14	2018/4/18	medium
75167	openSUSE Security Update : coreutils (openSUSE-SU-2013:0232-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
79171	CentOS 6 : coreutils (CESA-2013:1652)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium