{"id":"CVE-2017-18018","aliases":["ALPINE-CVE-2017-18018","BELL-CVE-2017-18018","DEBIAN-CVE-2017-18018","EUVD-2017-9158","MGASA-2019-0022","UBUNTU-CVE-2017-18018"],"status":"published","title":"CVE-2017-18018 does not affect BellSoft software","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00345,"percentile":0.28312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2018-01-04T04:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"coreutils","fixed_in":["8.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"coreutils","fixed_in":["8.29-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"coreutils","fixed_in":["8.30-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.29-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1-1","9.10-1","9.4-1","9.4-2","9.4-3","9.4-3.1","9.5-1","9.6-1","9.6-2","9.7-1","9.7-2","9.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.10-1","9.7-3"]},{"source":"osv","ecosystem":"Debian:14","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.10-1","9.7-3"]},{"source":"osv","ecosystem":"Mageia:6","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.25-3.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.20-3ubuntu5","8.21-1ubuntu3","8.21-1ubuntu4","8.21-1ubuntu5","8.21-1ubuntu5.1","8.21-1ubuntu5.3","8.21-1ubuntu5.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.23-4ubuntu2","8.25-2ubuntu2","8.25-2ubuntu3~16.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.26-3ubuntu4","8.28-1ubuntu1"]}],"products":[{"vendor":"gnu","product":"coreutils"}],"references":[{"url":"http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-18018","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-18018","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18018","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0022.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23825","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JK2ISMPYUEU3JS3L7AVXEHWCI56INCJJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4ZP6L5HXDOVKYTM5ELLYE64H75MT4LZR/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18018","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/01/04/3","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/coreutils/2017-12/msg00072.html","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/coreutils/2017-12/msg00073.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18018","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:00:00Z","modified":"2025-06-09T15:57:37.581Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9158","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:00:00Z","modified":"2025-06-09T15:57:37Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"nvd":[{"id":"CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:29:00.19Z","modified":"2026-06-17T01:12:02.94Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:04:12.690425Z"}],"osv":[{"id":"ALPINE-CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:29:00.19Z","modified":"2026-06-15T18:18:06.789624535Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-18018","title":"CVE-2017-18018 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:46.188477Z","modified":"2026-01-26T09:49:34.800557Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:29:00.19Z","modified":"2026-10-24T10:30:49.281508983Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:29:00.19Z","modified":"2026-09-01T20:03:46.911345589Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-18018","description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.","status":"published","published":"2018-01-04T04:29:00Z","modified":"2025-10-24T04:46:38Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2019-0022","title":"Updated coreutils packages fix security vulnerabilities","description":"A flaw was found in GNU Coreutils through 8.29 in chown-core.c. The\nfunctions chown and chgrp do not prevent replacement of a plain file\nwith a symlink during use of the POSIX \"-R -L\" options, which allows\nlocal users to modify the ownership of arbitrary files by leveraging a\nrace condition (CVE-2017-18018).\n\nA flaw was found in Gnulib before 2018-09-23. The convert_to_decimal\nfunction in vasnprintf.c has a heap-based buffer overflow because memory\nis not allocated for a trailing '\\0' character during %f processing\n(CVE-2018-17942).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:23:30.800623954Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}