Uutils

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option.

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations.

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation.

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE...

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames.

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition.

The id utility in uutils coreutils miscalculates the groups= section of its output.

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries.

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes.

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase.

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs.

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions.

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines.

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection.

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils.

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files.

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils.