CVE-2013-0221: Input Validation
It was reported [1] that the sort command suffered from a segfault when processing input streams that contained extremely long strings when used with the -d and -M switches. This flaw is due to the inclusion of the coreutils-i18n.patch.
SUSE has fixed this by fixing the patch. The changes can be seen here [2]. (There is probably e better place to get the patch, but I don't know where).
[1] https://bugzilla.novell.com/showbug.cgi?id=798538 [2] https://build.opensuse.org/request/show/149348#diffheadlinecoreutils-i18n-patchdiffaction0submit019
Statement:
(none)
Other sources
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0221?
CVE-2013-0221 has a medium severity rating due to its potential to cause segmentation faults.
How do I fix CVE-2013-0221?
To fix CVE-2013-0221, ensure that you apply the latest patches from your operating system vendor.
Which versions of software are affected by CVE-2013-0221?
CVE-2013-0221 affects Red Hat Enterprise Linux 6.0 and openSUSE versions 12.1 and 12.2.
What commands are associated with the vulnerability CVE-2013-0221?
The vulnerability CVE-2013-0221 is associated with the sort command when using the -d and -M switches.
What are the potential impacts of CVE-2013-0221?
The potential impacts of CVE-2013-0221 include application crashes and denial of service due to segmentation faults.