GNU Indent vulnerabilities

2 CVEs affecting GNU Indent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-0911, published 2024-02-06.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-40305, published 2023-08-14. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
• CVE-2024-0911, published 2024-02-06. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing…