CVE-2019-13636
CVE-2019-13636
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
CVSS 5.9 · Medium · EPSS 3.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
patch Debian:12
- Affected ranges
- ECOSYSTEM: < 2.7.6-5
Update to 2.7.6-5
patch Debian:13
- Affected ranges
- ECOSYSTEM: < 2.7.6-5
Update to 2.7.6-5
patch Debian:14
- Affected ranges
- ECOSYSTEM: < 2.7.6-5
Update to 2.7.6-5
patch Ubuntu:Pro:14.04:LTS
- Versions
- 2.7.1-3
- 2.7.1-4
- 2.7.1-4ubuntu1
- 2.7.1-4ubuntu2
- 2.7.1-4ubuntu2.3
- 2.7.1-4ubuntu2.4
- Affected ranges
- ECOSYSTEM: < 2.7.1-4ubuntu2.4+esm1
Update to 2.7.1-4ubuntu2.4+esm1
patch Ubuntu:16.04:LTS
- Versions
- 2.7.5-1
- 2.7.5-1ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 2.7.5-1ubuntu0.16.04.2
Update to 2.7.5-1ubuntu0.16.04.2
patch Ubuntu:18.04:LTS
- Versions
- 2.7.5-1build1
- 2.7.6-1
- 2.7.6-2ubuntu1
- Affected ranges
- ECOSYSTEM: < 2.7.6-2ubuntu1.1
Update to 2.7.6-2ubuntu1.1
Original sources
- https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a
- https://lists.debian.org/debian-lts-announce/2019/07/msg00016.html
- https://usn.ubuntu.com/4071-1/
- https://usn.ubuntu.com/4071-2/
- https://www.debian.org/security/2019/dsa-4489
- https://seclists.org/bugtraq/2019/Jul/54
- https://seclists.org/bugtraq/2019/Aug/29
- http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
- https://security.gentoo.org/glsa/201908-22
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/
- https://security.netapp.com/advisory/ntap-20190828-0001/
- https://github.com/irsl/gnu-patch-vulnerabilities
- https://nvd.nist.gov/vuln/detail/CVE-2019-13636