CVE Vulnerability Catalog

A logic error in the tr utility of uutils coreutils incorrectly defines the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space (0x20) in [:graph:] and excludes it from [:print:], reversing POSIX and GNU coreutils behavior. This can lead to unintended data modification or loss in automation scripts.

A logic error in the expr utility of uutils coreutils causes parenthesized subexpressions to be evaluated during parsing rather than execution. This prevents proper short-circuiting for logical OR (|) and AND (&), so arithmetic errors in branches that should be skipped are raised as fatal errors. This diverges from GNU expr behavior and can cause premature shell script termination.

A logic error in the env utility of uutils coreutils causes incorrect parsing of command-line arguments when using the -S (split-string) option. Unlike GNU env, the uutils implementation incorrectly validates sequences, resulting in an "invalid sequence" error and immediate termination with exit status 125 when encountering valid but unrecognized sequences like \a or \x.

A logic error in the split utility of uutils coreutils corrupts output filenames when given non-UTF-8 prefixes or suffixes. The implementation uses to_string_lossy(), replacing invalid byte sequences with the UTF-8 replacement character (U+FFFD), unlike GNU split which preserves raw bytes. This leads to files with incorrect names.

A logic error in the ln utility of uutils coreutils causes rejection of source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). Unlike GNU ln, the uutils implementation enforces UTF-8 encoding, resulting in a stat failure and non-zero exit code.

The id utility in uutils coreutils produces incorrect pretty-print output when the real UID and effective UID differ. It incorrectly uses the effective GID instead of the effective UID for the effective user name lookup, resulting in misleading diagnostics.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without explicit restricted permissions, inheriting umask-based permissions (typically 0644, world-readable). In multi-user environments, this allows any user to read the captured stdout/stderr output of a command.

The safe_traversal module in uutils coreutils, which protects against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to use these protections, leaving directory traversal operations vulnerable to symlink race conditions.

The mknod utility in uutils coreutils fails to handle security labels atomically, creating device nodes before setting the SELinux context. If labeling fails, it attempts cleanup with std::fs::remove_dir, which cannot remove device nodes or FIFOs, leaving mislabeled nodes with incorrect default contexts.

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users.

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input.

The dd utility in uutils coreutils suppresses errors during file truncation by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts.

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to check the only_delimited flag in cut_fields_newline_char_delim, causing non-delimited lines to be printed when they should be suppressed. This can pass unexpected data to downstream scripts.

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is empty, the uutils implementation treats the empty string as a valid path, creating temporary files in the current working directory instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, this may lead to unintended information disclosure or unauthorized access to temporary data.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers (DDR) request when triggered via the autoUpgrade (Lua) option for newServer or the auto_upgrade (YAML) setting. DDR is not enabled by default.

The vulnerability description is very sparse and only indicates a denial of service attack related to PRSD detection. Lack of technical details prevents full analysis.

A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries routed to a TCP-only or DNS over TLS backend.

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

In Spring Security, if an application uses the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes to enable, expire, or lock users, DaoAuthenticationProvider's timing attack defense can be bypassed for disabled, expired, or locked users. This affects Spring Security 5.7.0 through 5.7.22, 5.8.0 through 5.8.24, 6.3.0 through 6.3.15, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4.