Gnu vulnerabilities
1,240 vulnerabilities
Known vulnerabilities in Gnu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 130 products.
Products
50 of 130- Binutils288 vulnerabilities
- Glibc162 vulnerabilities
- Libredwg101 vulnerabilities
- Gnutls74 vulnerabilities
- Grub254 vulnerabilities
- Mailman46 vulnerabilities
- Emacs41 vulnerabilities
- Wget25 vulnerabilities
- Tar20 vulnerabilities
- Bash18 vulnerabilities
- Pspp18 vulnerabilities
- Libextractor15 vulnerabilities
- Patch15 vulnerabilities
- Cpio14 vulnerabilities
- Gcc14 vulnerabilities
- Recutils14 vulnerabilities
- Gzip13 vulnerabilities
- Libtasn113 vulnerabilities
- Coreutils11 vulnerabilities
- Groff10 vulnerabilities
- Privacy Guard10 vulnerabilities
- Gdb9 vulnerabilities
- Screen9 vulnerabilities
- Adns8 vulnerabilities
- Aspell8 vulnerabilities
- Inetutils8 vulnerabilities
- Mailutils8 vulnerabilities
- Gnump3D7 vulnerabilities
- Cfengine6 vulnerabilities
- Cflow6 vulnerabilities
- Elfutils6 vulnerabilities
- Libidn6 vulnerabilities
- Libmicrohttpd6 vulnerabilities
- Radius6 vulnerabilities
- A2Ps5 vulnerabilities
- Enscript5 vulnerabilities
- Gawk5 vulnerabilities
- Libcdio5 vulnerabilities
- Org Mode5 vulnerabilities
- Osip5 vulnerabilities
- Savane5 vulnerabilities
- Sharutils5 vulnerabilities
- Bison4 vulnerabilities
- Chess4 vulnerabilities
- Ed4 vulnerabilities
- Fribidi4 vulnerabilities
- Hurd4 vulnerabilities
- Inet4 vulnerabilities
- Libidn24 vulnerabilities
- Nano4 vulnerabilities
CVE-2026-111167gnulibredwg
EPSS score0.13%
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.CVE-2026-103658debianaspell+3EPSS score0.15%
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.CVE-2018-16868debiangnutls28+10EPSS score0.58%
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.CVE-2018-16430debianlibextractor+3EPSS score2.63%
GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.CVE-2018-13796ubuntumailman+3EPSS score2.54%
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.CVE-2018-13033debianbinutils+6EPSS score3.06%
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.CVE-2018-1000097canonicalubuntu_linux+5EPSS score1.96%
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..CVE-2018-1000001canonicalubuntu_linux+21EPSS score13.37%
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.CVE-2018-1000156alpinepatch+15EPSS score5.33%
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.CVE-2018-1000876canonicalubuntu_linux+6EPSS score0.65%
binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.CVE-2018-1000654alpinelibtasn1+9EPSS score2.01%
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.CVE-2018-19591debianglibc+3EPSS score5.53%
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.CVE-2018-19932alpinebinutils+4EPSS score1.99%
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.CVE-2018-19931alpinebinutils+5EPSS score1.61%
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.CVE-2018-11237canonicalubuntu_linux+11EPSS score0.88%
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.CVE-2018-11236debianglibc+17EPSS score7.05%
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.CVE-2018-20969alpinepatch+5EPSS score2.68%
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.CVE-2018-20431debianlibextractor+3EPSS score2.23%
GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.CVE-2018-20002alpinebinutils+5EPSS score1.82%
The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.CVE-2018-20673debianbinutils+47EPSS score1.64%
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.