The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary cod…

published 2015-01-16 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-9290

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.1%; EPSS 7.1% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

Patch / fix

fixed in 1 distros 2

gnu coreutils 8.23

debian ubuntu

coreutils Debian 14, Debian 13, Debian 12 8.23-1

debian advisories DEBIAN-CVE-2014-9471

coreutils Ubuntu 14.04 LTS 8.21-1ubuntu5.1

ubuntu advisories UBUNTU-CVE-2014-9471

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-9471 updated 2026-11-06 cvss 2.6

coreutils: memory corruption flaw in parse_datetime()

Red Hat Enterprise Linux 5 coreutils Red Hat Enterprise Linux 6 coreutils, coreutils-libs Red Hat Enterprise Linux 7 coreutils
affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.09% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

debbugs.gnu.org http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872 referenced PoC, tagged "exploit" by a source, unverified
openwall.com http://www.openwall.com/lists/oss-security/2014/11/25/1 referenced PoC, tagged "exploit" by a source, unverified
bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766147 referenced PoC, tagged "exploit" by a source, unverified
openwall.com http://www.openwall.com/lists/oss-security/2015/01/03/11 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

References

debbugs.gnu.org /cgi/bugreport.cgi?bug=16872
exploit, third-party-advisory
openwall.com /lists/oss-security/2014/11/25/1
mailing-list, exploit, third-party-advisory
bugs.debian.org /cgi-bin/bugreport.cgi?bug=766147
exploit, issue-tracking, third-party-advisory
openwall.com /lists/oss-security/2015/01/03/11
mailing-list, exploit, third-party-advisory
mandriva.com /security/advisories?name=MDVSA-2015:179
vendor-advisory, broken-link
security.gentoo.org /glsa/201612-22
vendor-advisory, third-party-advisory
ubuntu.com /usn/usn-2473-1
vendor-advisory, third-party-advisory
advisories.mageia.org /MGASA-2015-0029.html
third-party-advisory
openwall.com /lists/oss-security/2014/11/25/4
mailing-list, third-party-advisory
secunia.com /advisories/62226
third-party-advisory

Sources

CVE List CVE-2014-9471
NVD CVE-2014-9471

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary