CVE-2025-5899

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-5899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-5899
Downstream
Published
2025-06-09T22:15:22Z
Modified
2025-07-29T11:25:11.040781Z
Summary
[none]
Details

A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parsevariablesoption of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

References

Affected packages

Debian:11 / pspp

Package

Name
pspp
Purl
pkg:deb/debian/pspp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.1-1
1.5.4-1
1.5.4-2
1.5.4-3
1.5.5-1
1.6.0-1
1.6.2-1
1.6.2-2

2.*

2.0.0-1
2.0.0-2
2.0.0-3
2.0.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / pspp

Package

Name
pspp
Purl
pkg:deb/debian/pspp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.2-2

2.*

2.0.0-1
2.0.0-2
2.0.0-3
2.0.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / pspp

Package

Name
pspp
Purl
pkg:deb/debian/pspp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}