CVE-2015-4041

HIGH

GNU Coreutils < 8.23 - Heap-Based Buffer Overflow via Long UTF-8 Strings in sort

Title source: llm
STIX 2.1

Description

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.

References (3)

Core 3
Core References
Exploit, Mailing List, Patch, Third Party Advisory x_refsource_misc
http://openwall.com/lists/oss-security/2015/05/15/1
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.suse.com/show_bug.cgi?id=928749

Scores

CVSS v3 7.8
EPSS 0.0007
EPSS Percentile 20.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
gnu/coreutils < 8.23
Published Jan 24, 2020
Tracked Since Feb 18, 2026