PatchTheCVEpspp vulnerabilities and fixes
Recent CVEs affecting pspp, with upgrade or downgrade steps. 5 tracked.
pspp has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-05-16. Highest priority: CVE-2025-47815 (score 26/100).
- CVE-2025-48188 LOW 2.9 UPGRADE libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to
- CVE-2025-47816 LOW 2.9 UPGRADE libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes
- CVE-2025-47815 MEDIUM 4.5 UPGRADE libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_rea
- CVE-2025-47814 MEDIUM 4.5 UPGRADE libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_rea
- CVE-2025-47229 LOW 2.9 UPGRADE libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet as
FAQ
How do I fix pspp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pspp being exploited right now?
None of the tracked pspp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pspp CVE should I patch first?
CVE-2025-47815 currently ranks highest (26/100): libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_rea.