CVE-2014-9471

GNU coreutils < 8.23 - Denial of Service via Crafted Date String in parse_datetime

Title source: llm

Description

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

References (10)

Core 10

Core References

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2015:179

Third Party Advisory x_refsource_confirm

http://advisories.mageia.org/MGASA-2015-0029.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2014/11/25/4

Exploit, Third Party Advisory x_refsource_confirm

http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201612-22

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2014/11/25/1

Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766147

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/01/03/11

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/62226

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://ubuntu.com/usn/usn-2473-1

Scores

EPSS 0.0426

EPSS Percentile 88.9%

Details

Status published

Products (4)

canonical/ubuntu_linux 10.04

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 14.04

gnu/coreutils < 8.23

Published Jan 16, 2015

Tracked Since Feb 18, 2026