{"id":"CVE-2024-0684","state":"PUBLISHED","title":"Coreutils: heap overflow in split --line-bytes with very long lines","description":"A flaw was found in the GNU coreutils \"split\" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.","publishedAt":"2024-02-06T08:26:58.770Z","updatedAt":"2026-10-15T00:17:20.896Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"fedora"},"assigner":"fedora","products":["coreutils"],"affected":[{"packageName":"coreutils","defaultStatus":"unaffected","versions":[{"version":"v9.2","status":"affected"},{"version":"v9.3","status":"affected"},{"version":"v9.4","status":"affected"},{"version":"v9.5","status":"unaffected"}],"collectionURL":"https://git.savannah.gnu.org/gitweb/?p=coreutils.git"}],"references":["https://access.redhat.com/security/cve/CVE-2024-0684","https://bugzilla.redhat.com/show_bug.cgi?id=2258948","https://www.openwall.com/lists/oss-security/2024/01/18/2","https://security.netapp.com/advisory/ntap-20240808-0001/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KAURFJIEYY2BWCPN4AZDYCVMFD5J4GB/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0684.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-0684","state":"PUBLISHED","datePublished":"2024-02-06T08:26:58.770Z","dateUpdated":"2026-10-15T00:17:20.896Z","assignerShortName":"fedora","assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","dateReserved":"2024-01-18T14:13:44.638Z"},"containers":{"cna":{"title":"Coreutils: heap overflow in split --line-bytes with very long lines","descriptions":[{"lang":"en","value":"A flaw was found in the GNU coreutils \"split\" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service."}],"affected":[{"packageName":"coreutils","defaultStatus":"unaffected","versions":[{"version":"v9.2","status":"affected"},{"version":"v9.3","status":"affected"},{"version":"v9.4","status":"affected"},{"version":"v9.5","status":"unaffected"}],"collectionURL":"https://git.savannah.gnu.org/gitweb/?p=coreutils.git"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-0684","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258948","name":"RHBZ#2258948","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/18/2"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"fedora","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","dateUpdated":"2024-04-19T13:49:33.548Z"},"datePublic":"2024-01-18T00:00:00.000Z","x_redhatCweChain":"CWE-122: Heap-based Buffer Overflow","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2024-01-18T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-01-18T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-0684","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-02-06T15:37:23.097441Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:22:55.076Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-0684","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258948","name":"RHBZ#2258948","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/18/2","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240808-0001/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KAURFJIEYY2BWCPN4AZDYCVMFD5J4GB/"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T18:22:29.082Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:17:20.896Z"},"x_adpType":"supplier"}]}}}