GNU Ed vulnerabilities

4 CVEs affecting GNU Ed, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-5357, published 2017-02-17.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2008-3916, published 2008-09-04. High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE:…
• CVE-2017-5357, published 2017-02-17. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free.
• CVE-2000-1137, published 2001-01-09. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
• CVE-2006-6939, published 2007-01-17. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.