GNU Grep vulnerabilities

2 CVEs affecting GNU Grep, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-1345, published 2015-02-12.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-5667, published 2013-01-03. Medium severity, CVSS 4.4. EPSS: 1% chance of exploitation in the next 30 days. Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.
• CVE-2015-1345, published 2015-02-12. Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.