https://seclists.org/oss-sec/2024/q1/33: GNU coreutils v9.4; v9.3; v9.2 split heap buffer overflow vulnerability
Published Jan 19, 2024
·Updated
Affected Software
1 affected component
GNU Coreutils>=9.2<9.4
Frequently Asked Questions
1
What is the severity of CVE-2024-0001?
The severity of CVE-2024-0001 is categorized as high due to the potential for exploitation leading to arbitrary code execution.
2
How do I fix CVE-2024-0001?
To fix CVE-2024-0001, update your GNU Coreutils to version 9.4 or later.
3
What systems are affected by CVE-2024-0001?
CVE-2024-0001 affects GNU Coreutils versions 9.2, 9.3, and prior versions.
4
What is a heap buffer overflow in relation to CVE-2024-0001?
A heap buffer overflow in CVE-2024-0001 occurs when the split command in GNU Coreutils allows writing beyond allocated memory, potentially allowing for code execution.
5
Is there a workaround for CVE-2024-0001 if I cannot update?
If you cannot update to a patched version, avoid using the split command on untrusted or malformed input to mitigate risks associated with CVE-2024-0001.