Gnu
Page 2 of 8 — Gnu CVEs from a corpus of 783, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54771 | Medium | 4.9 | 2025-11-18 | A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly ret… |
CVE-2025-54770 | Medium | 4.9 | 2025-11-18 | A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Fre… |
CVE-2025-62689 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-59777 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-11840 | Low | 3.3 | 2025-10-16 | A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out… |
CVE-2025-11839 | Low | 3.3 | 2025-10-16 | A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchec… |
CVE-2025-11495 | Low | 3.3 | 2025-10-08 | A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the compone… |
CVE-2025-11494 | Low | 3.3 | 2025-10-08 | A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. T… |
CVE-2025-11414 | Low | 3.3 | 2025-10-07 | A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the compon… |
CVE-2025-11413 | Low | 3.3 | 2025-10-07 | A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The man… |
CVE-2025-11412 | Low | 3.3 | 2025-10-07 | A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The… |
CVE-2025-11083 | Medium | 5.3 | 2025-09-27 | A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. T… |
CVE-2025-11082 | Medium | 5.3 | 2025-09-27 | A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing… |
CVE-2025-11081 | Low | 3.3 | 2025-09-27 | A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation r… |
CVE-2025-59378 | Medium | 5.7 | 2025-09-15 | In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the pr… |
CVE-2025-8746 | Low | 3.3 | 2025-08-09 | A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to me… |
CVE-2025-8736 | Medium | 5.3 | 2025-08-08 | A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the c… |
CVE-2025-8735 | Low | 3.3 | 2025-08-08 | A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the compone… |
CVE-2025-8225 | Low | 3.3 | 2025-07-27 | A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c o… |
CVE-2025-8224 | Low | 3.3 | 2025-07-27 | A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file… |
CVE-2025-7546 | Medium | 5.3 | 2025-07-13 | A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of… |
CVE-2025-7545 | Medium | 5.3 | 2025-07-13 | A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objc… |
CVE-2025-45582 | Medium | 4.1 | 2025-07-11 | GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an… |
CVE-2025-32990 | Medium | 6.5 | 2025-07-10 | A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain sett… |
CVE-2025-32989 | Medium | 5.3 | 2025-07-10 | A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension durin… |
CVE-2025-32988 | Medium | 6.5 | 2025-07-10 | A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (S… |
CVE-2025-6141 | Low | 3.3 | 2025-06-16 | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of… |
CVE-2025-5899 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_var… |
CVE-2025-5898 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of… |
CVE-2025-5745 | Medium | 5.6 | 2025-06-05 | The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving… |
CVE-2025-5702 | Medium | 5.6 | 2025-06-05 | The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving… |
CVE-2025-5245 | Medium | 5.3 | 2025-05-27 | A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of t… |
CVE-2025-5244 | Medium | 5.3 | 2025-05-27 | A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflin… |
CVE-2025-5001 | Low | 3.3 | 2025-05-20 | A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function ca… |
CVE-2025-48188 | Low | 2.9 | 2025-05-16 | libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a… |
CVE-2025-4802 | High | 7.8 | 2025-05-16 | Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared… |
CVE-2025-47816 | Low | 2.9 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at… |
CVE-2025-47815 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in… |
CVE-2025-47814 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in… |
CVE-2025-47229 | Low | 2.9 | 2025-05-03 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted… |
CVE-2025-43921 | Medium | 5.3 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third par… |
CVE-2025-43920 | Medium | 5.4 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS comma… |
CVE-2025-43919 | Medium | 5.8 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/ma… |
CVE-2025-3198 | Low | 3.3 | 2025-04-04 | A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file… |
CVE-2025-0686 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the fi… |
CVE-2025-0685 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry t… |
CVE-2025-0684 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the file… |
CVE-2025-0678 | High | 7.8 | 2025-03-03 | A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry t… |
CVE-2024-45782 | High | 7.8 | 2025-03-03 | A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-prov… |
CVE-2024-45778 | Medium | 4.1 | 2025-03-03 | A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. |
CVE-2025-1125 | High | 7.8 | 2025-03-03 | When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal bu… |
CVE-2025-0689 | High | 7.8 | 2025-03-03 | When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain sc… |
CVE-2024-45780 | Medium | 6.7 | 2025-03-03 | A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation ag… |
CVE-2024-45779 | Medium | 6.0 | 2025-03-03 | An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number… |
CVE-2024-45777 | Medium | 6.7 | 2025-02-19 | A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, lead… |
CVE-2025-1377 | Low | 3.3 | 2025-02-17 | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip… |
CVE-2025-1376 | Low | 2.5 | 2025-02-17 | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr… |
CVE-2025-1372 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_strin… |
CVE-2025-1371 | Low | 3.3 | 2025-02-17 | A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file r… |
CVE-2025-1365 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the compo… |
CVE-2025-1352 | Medium | 5.0 | 2025-02-16 | A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library lib… |
CVE-2025-1182 | Medium | 5.0 | 2025-02-11 | A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elfl… |
CVE-2025-1181 | Medium | 5.0 | 2025-02-11 | A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c… |
CVE-2025-1180 | Low | 3.1 | 2025-02-11 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh… |
CVE-2025-1179 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of th… |
CVE-2025-1178 | Medium | 5.6 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libb… |
CVE-2025-1176 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the c… |
CVE-2025-1153 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format… |
CVE-2025-1152 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The… |
CVE-2025-1151 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the componen… |
CVE-2025-1150 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of… |
CVE-2025-1149 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the… |
CVE-2025-1148 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c… |
CVE-2025-1147 | Low | 3.1 | 2025-02-10 | A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen… |
CVE-2025-0840 | Medium | 5.0 | 2025-01-29 | A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/ob… |
CVE-2024-56738 | Medium | 5.3 | 2024-12-29 | GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. |
CVE-2024-56737 | High | 8.8 | 2024-12-29 | GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. |
CVE-2024-53920 | High | 7.8 | 2024-11-27 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can… |
CVE-2024-10524 | Medium | 6.5 | 2024-11-19 | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attac… |
CVE-2024-50610 | Low | 3.6 | 2024-10-27 | GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect m… |
CVE-2024-39331 | Critical | 9.8 | 2024-06-23 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-str… |
CVE-2024-38428 | Critical | 9.1 | 2024-06-16 | url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was su… |
CVE-2024-36600 | High | 8.4 | 2024-06-14 | Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. |
CVE-2024-5742 | Medium | 6.7 | 2024-06-12 | A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file i… |
CVE-2024-33602 | High | 7.4 | 2024-05-06 | nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callbac… |
CVE-2024-33601 | High | 7.3 | 2024-05-06 | nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and thes… |
CVE-2024-33600 | Medium | 5.9 | 2024-05-06 | nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, th… |
CVE-2024-33599 | High | 8.1 | 2024-05-06 | nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subseque… |
CVE-2024-2961 | High | 7.3 | 2024-04-17 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the I… |
CVE-2024-29399 | High | 7.6 | 2024-04-11 | An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the u… |
CVE-2024-27632 | High | 8.8 | 2024-04-08 | An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function. |
CVE-2024-27631 | Medium | 6.0 | 2024-04-08 | Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php |
CVE-2024-27630 | High | 7.5 | 2024-04-08 | Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_da… |
CVE-2024-2312 | Medium | 6.7 | 2024-04-05 | GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to… |
CVE-2023-39804 | Medium | 6.2 | 2024-03-27 | In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. |
CVE-2024-30205 | High | 7.1 | 2024-03-25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. |
CVE-2024-30204 | Low | 2.8 | 2024-03-25 | In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. |
CVE-2024-30203 | Medium | 5.5 | 2024-03-25 | In Emacs before 29.3, Gnus treats inline MIME contents as trusted. |
CVE-2024-30202 | High | 7.8 | 2024-03-25 | In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. |
CVE-2023-7207 | Medium | 4.9 | 2024-02-29 | Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absol… |