CVE-2025-5001

Name of the Vulnerable Software and Affected Versions GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb

Description A vulnerability was found in GNU PSPP, affecting the calloc function in the pspp-convert.c file. The manipulation of the argument -l leads to integer overflow. Local access is required to approach this attack.

Recommendations For GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb, as a temporary workaround, consider restricting access to the pspp-convert.c file and avoiding the use of the -l argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.