PT-2025-24572 · Gnu+1 · Gnu Pspp+1

Nez · Published 2025-06-09 · Updated 2025-06-09 · CVE-2025-5899

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb

Description A critical issue was found in the parse variables option function of the file utilities/pspp-convert.c. This issue leads to the freeing of memory not on the heap. An attack must be launched locally. The exploit has been publicly disclosed.

Recommendations For GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb, as a temporary workaround, consider disabling the parse variables option function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-590

Related Identifiers

CVE-2025-5899

Affected Products

Debian

Gnu Pspp

References · 14

• 🔥 https://savannah.gnu.org/bugs/index.php?67072 · Exploit
• 🔥 https://drive.google.com/file/d/1YPJLiBzOwVTcc2FzdawYxBJWGujwqy7o/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5899 · Security Note
• https://ubuntu.com/security/CVE-2025-5899 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5899 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5899 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-5899 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5899 · Vendor Advisory
• https://vuldb.com/?id.311671 · Note
• https://vuldb.com/?ctiid.311671 · Note
• https://gnu.org · Note
• https://vuldb.com/?submit.586106 · Note
• https://twitter.com/CVEnew/status/1932205308870279524 · Twitter Post