CVE-2015-1345 — grep: heap buffer overrun

Back Back to CVE browser

LOW

grep: heap buffer overrun

Published Feb 12, 2015

2.1

LOW

CVSS 2.0

EPSS 0.49%

Description

The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.

Affected products

Red Hat Enterprise Linux 6

grep-0:2.20-3.el6

Fixed · RHSA-2015:1447
Red Hat Enterprise Linux 7

grep-0:2.20-2.el7

Fixed · RHSA-2015:2111
Red Hat Enterprise Linux 5

grep

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	grep-0:2.20-3.el6	Fixed	RHSA-2015:1447
Red Hat Enterprise Linux 7	grep-0:2.20-2.el7	Fixed	RHSA-2015:2111
Red Hat Enterprise Linux 5	grep	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect versions of grep as shipped in Red Hat Enterprise Linux 5.

Metrics

0.49% 0.00486

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00486

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.49% (0.00486)	39.60th	v5 (v2026.06.15)
Jun 15, 2026	0.49% (0.00486)	37.84th	v5 (v2026.06.15)
Mar 30, 2025	0.14% (0.00135)	29.97th	v4 (v2025.03.14)
Mar 29, 2025	1.83% (0.01834)	71.81th	v4 (v2025.03.14)
Mar 17, 2025	0.14% (0.00135)	30.74th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.03% (0.01034)	41.69th	v2 (v2022.01.01)
Sep 10, 2022	1.03% (0.01034)	39.91th	v2 (v2022.01.01)
Apr 1, 2022	1.03% (0.01034)	37.91th	v2 (v2022.01.01)
Feb 4, 2022	1.03% (0.01034)	20.32th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (11)

http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563
x_refsource_CONFIRMExploit
http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2015-02/msg00037.html
vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-1447.html
vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2015/01/22/10
mailing-listx_refsource_MLIST
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
x_refsource_CONFIRM
http://www.securityfocus.com/bid/72281
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2015-1345
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1183651
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2015-1345
https://www.cve.org/CVERecord?id=CVE-2015-1345

Link	Providers	Tags
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563		x_refsource_CONFIRMExploit
http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2015-02/msg00037.html		vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-1447.html		vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2015/01/22/10		mailing-listx_refsource_MLIST
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html		x_refsource_CONFIRM
http://www.securityfocus.com/bid/72281		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2015-1345		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1183651		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2015-1345
https://www.cve.org/CVERecord?id=CVE-2015-1345