Back
CVE-2024-0684
Coreutils: heap overflow in split --line-bytes with very long lines
Medium5.5EPSS 0.49%
- Published
- Updated
- Reserved
- Assigned by
- fedora
Description
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| fedoraCNA (assigner) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.49% · top 58% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
coreutils
- affected v9.2
- affected v9.3
- affected v9.4
- unaffected v9.5
What to do
Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (6)
- https://access.redhat.com/security/cve/CVE-2024-0684 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
- RHBZ#2258948 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
- https://www.openwall.com/lists/oss-security/2024/01/18/2 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20240808-0001/ (opens in a new tab)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2KAURFJIEYY2BWCPN4AZDYCVMFD5J4GB/ (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-0684)Record last updated .