Fluid Attacks Database

Description

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	coreutils	>=0 <8.23-1	8.23-1
debian 11	coreutils	>=0 <8.23-1	8.23-1
debian 14	coreutils	>=0 <8.23-1	8.23-1
rpm rhel7	coreutils	-	-
debian 13	coreutils	>=0 <8.23-1	8.23-1
rpm rhel6	coreutils	-	-
rpm rhel5	coreutils	-	-

Aliases

1. CVE-2014-94712. NVD-2014-94713. OSV-DEBIAN-2014-94714. OSV-2014-94715. SECURITY-TRACKER-CVE-2014-9471

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.