Affected: AlmaLinux:9: coreutils, AlmaLinux:9: coreutils-common, AlmaLinux:9: coreutils-single

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: coreutils, Alpaquita:25: coreutils, Alpaquita:stream: coreutils, BellSoft Hardened Containers:23: coreutils, BellSoft Hardened Containers:25: coreutils, BellSoft Hardened Containers:stream: coreutils

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Affected: openEuler:20.03-LTS-SP4: coreutils, openEuler:22.03-LTS-SP3: coreutils, openEuler:22.03-LTS-SP4: coreutils, openEuler:24.03-LTS: coreutils, openEuler:24.03-LTS-SP1: coreutils

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages. Security Fix(es):

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.(CVE-2025-5278)

coreutils-9.7-3.1 on GA media

libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification libxslt: use-after-free with key data stored cross-RVT libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite nginx: ngx_http_rewrite_module: code execution and denial of service openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion vim: Command injection allows arbitrary code execution via malicious tag files urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

Affected: Rocky Linux:9: coreutils

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for coreutils

Affected: Ubuntu:14.04:LTS: coreutils, Ubuntu:16.04:LTS: coreutils, Ubuntu:18.04:LTS: coreutils, Ubuntu:20.04:LTS: coreutils, Ubuntu:22.04:LTS: coreutils, Ubuntu:24.04:LTS: coreutils, Ubuntu:25.10: coreutils, Ubuntu:26.04:LTS: coreutils

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain OS ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, um erweiterte Rechte zu erlangen – einschließlich Administratorrechte –, um Sicherheitsmaßnahmen zu umgehen, um Daten zu manipulieren, um vertrauliche Informationen offenzulegen oder um andere, nicht näher spezifizierte Angriffe durchzuführen.