vulnti.work

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafte…

中危 CVSS 4.4
CVECVE-2025-5278
首次发现2026-07-15 16:15 UTC
披露时间2025-05-27 21:15 UTC
最后更新2026-07-21 06:15 UTC
通道状态auto

摘要

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。

深度研判 · 自动通道

该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。

Lint 边界警告 (4)

以下是本次研判 lint 阶段发现的非阻塞性警告（如引用 URL 未在白名单内）。这些不影响漏洞条目可用性，仅为透明度披露（参 DR-002）。

  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD