{"id":"CVE-2013-0222","aliases":["EUVD-2013-0256","GHSA-833h-pm7q-jw8w","RHSA-2013:1652","SUSE-SU-2015:0792-1","openSUSE-SU-2024:10390-1"],"status":"published","title":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a...","description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00384,"percentile":0.32714,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2013-11-23T18:00:00Z","modified":"2026-06-28T10:08:56Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"coreutils-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"coreutils-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"coreutils-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"coreutils-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4-31.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.26-1.1"}]}],"bundled":5}],"products":[{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=903465","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1652.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=796243","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0222","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1652","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0222","tags":["report"]},{"url":"https://github.com/advisories/GHSA-833h-pm7q-jw8w"},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/coreutils.html#RHSA-2013-1652","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=747592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=816708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=827199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=842040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=903464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=903466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=965654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1006221","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1652.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0221","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0222","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0223","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150792-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/796243","tags":["report"]},{"url":"https://bugzilla.suse.com/798538","tags":["report"]},{"url":"https://bugzilla.suse.com/798541","tags":["report"]},{"url":"https://bugzilla.suse.com/886129","tags":["report"]},{"url":"https://bugzilla.suse.com/892862","tags":["report"]},{"url":"https://bugzilla.suse.com/911832","tags":["report"]},{"url":"https://bugzilla.suse.com/919809","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9471","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4042","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-0222","description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.","status":"published","published":"2013-11-23T18:00:00Z","modified":"2024-08-06T14:18:09.455Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0256","description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.","status":"published","published":"2013-11-23T18:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:46.251982Z"}],"ghsa":[{"id":"GHSA-833h-pm7q-jw8w","title":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a...","description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.","status":"published","published":"2022-05-05T02:48:35Z","modified":"2023-02-10T05:06:36Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:02.310741Z"}],"nvd":[{"id":"CVE-2013-0222","description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.","status":"published","published":"2013-11-23T18:55:04.173Z","modified":"2026-06-16T23:48:59.993Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"openSUSE-SU-2024:10390-1","title":"coreutils-8.26-1.1 on GA media","description":"These are all security issues fixed in the coreutils-8.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:52.914085Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:1652","title":"Red Hat Security Advisory: coreutils security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:02:11Z","modified":"2026-06-28T10:08:56Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:0792-1","title":"Recommended update for coreutils","description":"\nThis update for coreutils provides the following fixes and enhancements:\n\n    * cp(1) could read from freed memory and could even make corrupt\n      copies. This could happen with a very fragmented and sparse input\n      file, on file systems supporting filemap extent scanning.\n      (bnc#892862)\n    * Improve ls(1) efficiency on large directories by caching some system\n      call error codes (ENOTSUP for example) and not calling them again for\n      files in the same device. (bnc#886129)\n\n","status":"published","published":"2014-10-16T23:59:36Z","modified":"2026-02-04T02:36:39.656353Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}