CVE-2014-9471: The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) o...

Security readout for executives and security teams

CVE-2014-9471 is a GNU coreutils date-parsing flaw. A specially crafted date string can crash programs such as date or touch, and the CVE description says arbitrary code execution may be possible. Business risk is highest where services or automation pass untrusted date input into coreutils. Likely exposure is indirect: Unix/Linux systems where scripts, web handlers, job processors, or APIs feed attacker-controlled date strings to GNU coreutils utilities. Systems using only trusted local date inputs have lower practical exposure. Exact affected versions are not identified in the source bundle. Treat as a targeted remediation item, not an emergency based on the provided evidence. Prioritize exposed automation paths that parse user-controlled dates, then complete normal operating system patching. Mitigation focus: Apply GNU coreutils security updates from the operating system vendor.; Review Mandriva, Mageia, Gentoo, Ubuntu, and Debian guidance for applicable packages.; Avoid passing untrusted date strings directly to coreutils utilities..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.