Hi,

The following vulnerability was published for coreutils.

CVE-2025-5278[0]:
| A flaw was found in GNU Coreutils. The sort utility's begfield()
| function is vulnerable to a heap buffer under-read. The program may
| access memory outside the allocated buffer if a user runs a crafted
| command using the traditional key format. A malicious input could
| lead to a crash or leak sensitive data.

Not sure why this got a CVE assigned, it seems like a regular crash
without genuine security implications.

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507
https://www.openwall.com/lists/oss-security/2025/05/27/2

https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-5278
https://www.cve.org/CVERecord?id=CVE-2025-5278

Please adjust the affected versions in the BTS as needed.

Hi,

Three coreutils entries in data/CVE/list look like they have stale version
data. Each correction rests on upstream's own "[bug introduced in ...]"
tags in
NEWS. I checked debian/patches for 9.1-1, 9.7-3 and 9.10-1, and none of them
carries the multi-byte expand/unexpand code early (the series files are only
61_whoips, 63_dd-appenderrors, 72_id_checkngroups and gnulib-nfs-acl).

1. CVE-2026-56392 (unexpand -t heap overflow), fixed upstream in
b60a159fdc5b.
   NEWS for 9.12 says: "'unexpand -t' no longer overflows a heap buffer ...
   [bugs introduced in coreutils-9.11]". The vulnerable code arrived with
   multi-byte expand/unexpand support in 9.11 ("'expand' and 'unexpand' now
   support multi-byte characters."). Debian ships 9.1, 9.7 and 9.10, so no
   suite is affected. Suggested entry:

        - coreutils <not-affected> (Vulnerable code introduced in 9.11)

2. CVE-2026-56391 (uniq -w read overrun), fixed upstream in d64e35a8a4c0.
   NEWS for 9.12 says: "'uniq -w' no longer overruns the read buffer in
   multibyte locales. [bug introduced in coreutils-9.5]". Bookworm's 9.1-1
   predates that; trixie (9.7) and sid (9.10) are affected. Suggested
addition:

        [bookworm] - coreutils <not-affected> (Vulnerable code introduced
in 9.5)

3. CVE-2025-5278 (sort key-offset heap under-read, #1106733), fixed
upstream in
   8c9602e3a145, which shipped in coreutils 9.8 (2025-09-22). sid's first
   upload at or above 9.8 is 9.10-1. The tracker still lists sid as unfixed.
   Suggested change to the unstable line:

        - coreutils 9.10-1 (unimportant; bug #1106733)

   #1106733 could also be closed with version 9.10-1.

References:
https://cgit.git.savannah.gnu.org/cgit/coreutils.git/plain/NEWS

https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371

https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633

Thanks,
Josh Spork