Most recent entries from all

ALSA-2026:28911 — Moderate: coreutils security update

Affected: AlmaLinux:9: coreutils, AlmaLinux:9: coreutils-common, AlmaLinux:9: coreutils-single

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-10950

BELL-CVE-2025-5278

Affected: Alpaquita:23: coreutils, Alpaquita:25: coreutils, Alpaquita:stream: coreutils, BellSoft Hardened Containers:23: coreutils, BellSoft Hardened Containers:25: coreutils, BellSoft Hardened Containers:stream: coreutils

certfr-2025-avi-0756 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0756

cnvd-2025-11923

EUVD-2026-377854

fkie_cve-2025-5278

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

GHSA-ch64-4x3c-w3jq

msrc_CVE-2025-5278 — Coreutils: heap buffer under-read in gnu coreutils sort via key specification

msrc_CVE-2025-5278

OESA-2025-1637 — coreutils security update

Affected: openEuler:20.03-LTS-SP4: coreutils, openEuler:22.03-LTS-SP3: coreutils, openEuler:22.03-LTS-SP4: coreutils, openEuler:24.03-LTS: coreutils, openEuler:24.03-LTS-SP1: coreutils

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages. Security Fix(es):

openSUSE-SU-2025:15327-1 — coreutils-9.7-3.1 on GA media

coreutils-9.7-3.1 on GA media

RHSA-2026:33313 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification libxslt: use-after-free with key data stored cross-RVT libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite nginx: ngx_http_rewrite_module: code execution and denial of service openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion vim: Command injection allows arbitrary code execution via malicious tag files urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

RLSA-2026:28911 — Moderate: coreutils security update

Affected: Rocky Linux:9: coreutils

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2025:02353-1 — Security update for coreutils

Security update for coreutils

UBUNTU-CVE-2025-5278

Affected: Ubuntu:14.04:LTS: coreutils, Ubuntu:16.04:LTS: coreutils, Ubuntu:18.04:LTS: coreutils, Ubuntu:20.04:LTS: coreutils, Ubuntu:22.04:LTS: coreutils, Ubuntu:24.04:LTS: coreutils, Ubuntu:25.10: coreutils, Ubuntu:26.04:LTS: coreutils

WID-SEC-W-2026-1118 — Dell PowerProtect Data Domain OS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain OS ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, um erweiterte Rechte zu erlangen – einschließlich Administratorrechte –, um Sicherheitsmaßnahmen zu umgehen, um Daten zu manipulieren, um vertrauliche Informationen offenzulegen oder um andere, nicht näher spezifizierte Angriffe durchzuführen.