{"id":"CVE-2012-5667","aliases":["BELL-CVE-2012-5667","DEBIAN-CVE-2012-5667","EUVD-2012-5550","GHSA-ww72-x43x-r55q","RHSA-2015:1447"],"status":"published","title":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to...","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01022,"percentile":0.63665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-189"],"published":"2013-01-03T11:00:00Z","modified":"2026-10-23T17:47:48Z","exploits":[{"source":"exploitdb","id":"EDB-23779","title":"Grep \u003c 2.11 - Integer Overflow Crash (PoC)","type":"dos","platform":"linux","date":"2012-12-31","verified":true,"url":"https://www.exploit-db.com/exploits/23779"}],"fixes":[{"ecosystem":"Debian:12","package":"grep","fixed_in":["2.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"grep","fixed_in":["2.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"grep","fixed_in":["2.11-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"grep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"grep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"grep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"grep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"grep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20-3.el6"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"grep"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/57033","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://git.sv.gnu.org/gitweb/?p=grep.git%3Ba=shortlog%3Bh=v2.11","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://git.savannah.gnu.org/cgit/grep.git/commit/?id=8fcf61523644df42e1905c81bed26838e0b04f91","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889935","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1447.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.gnu.org/archive/html/bug-grep/2012-12/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://openwall.com/lists/oss-security/2012/12/22/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5667","tags":["advisory"]},{"url":"http://git.sv.gnu.org/gitweb/?p=grep.git;a=shortlog;h=v2.11"},{"url":"https://github.com/advisories/GHSA-ww72-x43x-r55q"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2012-5667","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-5667","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1447","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=799863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=982215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1103270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1167766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1183651","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1447.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5667","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5667","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1345","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-5667","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2013-01-03T11:00:00Z","modified":"2024-08-06T21:14:16.359Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2012-5550","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2013-01-03T11:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.024018Z"}],"ghsa":[{"id":"GHSA-ww72-x43x-r55q","title":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to...","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2022-05-17T03:17:31Z","modified":"2025-04-11T04:07:08Z","updated_at":"2026-11-02T15:01:13.040475Z"}],"nvd":[{"id":"CVE-2012-5667","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2013-01-03T11:54:25.417Z","modified":"2026-06-16T23:47:12.983Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"BELL-CVE-2012-5667","title":"CVE-2012-5667 does not affect BellSoft software","status":"withdrawn","published":"2013-01-03T11:54:00Z","modified":"2026-01-28T07:19:24.90337Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2012-5667","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2013-01-03T11:54:25Z","modified":"2026-04-10T03:44:20.919991Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2012-5667","description":"Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.","status":"published","published":"2013-01-03T11:54:25.417Z","modified":"2026-10-23T17:47:48.000100366Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"RHSA-2015:1447","title":"Red Hat Security Advisory: grep security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:19:19Z","modified":"2026-06-28T10:14:18Z","updated_at":"2026-11-02T15:53:03.182161Z"}]}}