CVE-2014-9471
Summary
| CVE | CVE-2014-9471 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-01-16 16:59:00 UTC |
| Updated | 2020-12-08 15:18:00 UTC |
| Description | The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 10.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 10.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Application | Gnu | Coreutils | All | All | All | All |
| Application | Gnu | Coreutils | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| USN-2473-1: coreutils vulnerabilities | Ubuntu | UBUNTU | ubuntu.com | Third Party Advisory |
| #16872 - `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes - GNU bug report logs | CONFIRM | debbugs.gnu.org | Exploit, Third Party Advisory |
| oss-security - parse_datetime() bug in coreutils | MLIST | www.openwall.com | Exploit, Mailing List, Third Party Advisory |
| #766147 - php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled - Debian Bug report logs | CONFIRM | bugs.debian.org | Exploit, Issue Tracking, Third Party Advisory |
| Support / Security / Advisories / / MDVSA-2015:179 | Mandriva | MANDRIVA | www.mandriva.com | Broken Link |
| Mageia Advisory: MGASA-2015-0029 - Updated coreutils packages fix CVE-2014-9471 | CONFIRM | advisories.mageia.org | Third Party Advisory |
| oss-security - AW: parse_datetime() bug in coreutils | MLIST | www.openwall.com | Mailing List, Third Party Advisory |
| oss-security - Re: parse_datetime() bug in coreutils | MLIST | www.openwall.com | Exploit, Mailing List, Third Party Advisory |
| Security Advisory SA62226 - Ubuntu update for coreutils - Secunia | SECUNIA | secunia.com | Third Party Advisory |
| Coreutils: Arbitrary code execution (GLSA 201612-22) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.