CVE-2013-0221 describes a stack-based buffer overflow vulnerability in GNU coreutils, specifically within the 'sort' command when using the -d or -M switches with a long input string. This flaw, patched in SUSE's coreutils-i18n.patch, primarily affects SUSE and Red Hat Enterprise Linux distributions. Rated with a CVSS score of 4.3, it is a medium-severity vulnerability that can lead to a denial of service (segmentation fault and crash) with moderate attack complexity and no confidentiality or integrity impact. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-38232) for a local buffer overflow exists, and there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | ||
12.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* | ||
12.2CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:N/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2013-0221
Sep 8, 2020The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command when using the (1) -d or (2) -M switch which triggers a stack-based buffer overflow in the alloca function.
Nov 2, 2013coreutils: segfault in "sort -d" and "sort -M" with long line input
Jan 15, 2013