Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

According to the versions of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The keycompare_mb function in sort.c in sort in GNU     Coreutils through 8.23 on 64-bit platforms performs a     size calculation without considering the number of     bytes occupied by multibyte characters, which allows     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via long UTF-8     strings.(CVE-2015-4041)

  - Integer overflow in the keycompare_mb function in     sort.c in sort in GNU Coreutils through 8.23 might     allow attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via long strings.(CVE-2015-4042)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for coreutils provides the following fixes :

  - Fix memory handling error with case insensitive sort     using UTF-8. (CVE-2015-4041, CVE-2015-4042)

  - Ensure 'df -a' shows all remote file system entries.

  - Only suppress remote mounts of separate exports with 'df
    --total'.

  - Document that 'df -a' might list duplicated file     systems.

  - Adjust references to info nodes in man pages.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

coreutils was updated to fix one security issue and one non-security bug.

The following vulnerability was fixed :

  - CVE-2015-4042: Use a later version of the patch that     fixed (boo#928749, CVE-2015-4041), also avoiding I18N     issue

The following bug was fixed :

  - boo#933396: adjust reference to info nodes in man pages

ID	Name	Product	Family	Severity
137505	EulerOS 2.0 SP2 : coreutils (EulerOS-SA-2020-1663)	Nessus	Huawei Local Security Checks	critical
135503	EulerOS 2.0 SP3 : coreutils (EulerOS-SA-2020-1374)	Nessus	Huawei Local Security Checks	critical
86184	SUSE SLED12 / SLES12 Security Update : coreutils (SUSE-SU-2015:1637-1)	Nessus	SuSE Local Security Checks	critical
84186	openSUSE Security Update : coreutils / coreutils-testsuite (openSUSE-2015-420)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2015-4042

critical

Tenable Plugins

critical

critical

critical

critical