Vulnerabilities

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1.

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets.

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context.

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation.

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode…

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations.

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines.

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable.

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations.

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files.

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism.