A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - patch: OS shell command injection when processing crafted patch files (CVE-2019-13638)

  - An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c     can possibly lead to DoS via a crafted input file. (CVE-2016-10713)

  - GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files,     specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to     be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's     CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
    (CVE-2018-1000156)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.
    NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated     to a shell metacharacter. (CVE-2018-20969)

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

  - GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function     another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists     because of an incomplete fix for CVE-2018-6952. (CVE-2019-20633)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function     another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists     because of an incomplete fix for CVE-2018-6952. (CVE-2019-20633)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-2033 advisory.

  - An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c     can possibly lead to DoS via a crafted input file. (CVE-2016-10713)

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1932-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1925-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the patch package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free exists in the another_hunk function in     pch.c in GNU patch through 2.7.6.(CVE-2018-6952)

  - Directory traversal vulnerability in GNU patch versions     which support Git-style patching before 2.7.3 allows     remote attackers to write to arbitrary files with the     permissions of the target user via a .. (dot dot) in a     diff file name.(CVE-2015-1395)

  - An issue was discovered in GNU patch before 2.7.6.
    Out-of-bounds access within pch_write_line() in pch.c     can possibly lead to DoS via a crafted input     file.(CVE-2016-10713)

  - GNU patch 2.7.2 and earlier allows remote attackers to     cause a denial of service (memory consumption and     segmentation fault) via a crafted diff     file.(CVE-2014-9637)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2015-1196)

  - GNU patch through 2.7.6 is vulnerable to OS shell     command injection that can be exploited by opening a     crafted patch file that contains an ed style diff     payload with shell metacharacters. The ed editor does     not need to be present on the vulnerable system. This     is different from CVE-2018-1000156.(CVE-2019-13638)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does     not block strings beginning with a ! character. NOTE:
    this is the same commit as for CVE-2019-13638, but the     ! syntax is specific to ed, and is unrelated to a shell     metacharacter.(CVE-2018-20969)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has patch packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GNU patch before 2.7.6. Out-     of-bounds access within pch_write_line() in pch.c can     possibly lead to DoS via a crafted input file.
    (CVE-2016-10713)

  - A double free exists in the another_hunk function in     pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - GNU patch through 2.7.6 is vulnerable to OS shell     command injection that can be exploited by opening a     crafted patch file that contains an ed style diff     payload with shell metacharacters. The ed editor does     not need to be present on the vulnerable system. This is     different from CVE-2018-1000156. (CVE-2019-13638)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does     not block strings beginning with a ! character. NOTE:
    this is the same commit as for CVE-2019-13638, but the !     syntax is specific to ed, and is unrelated to a shell     metacharacter. (CVE-2018-20969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638 , but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.(CVE-2018-20969)

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156 . (CVE-2019-13638)

A heap-based out-of-bounds read flaw was found in the way the patch utility parsed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patch files.(CVE-2016-10713)

A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches.(CVE-2018-6952)

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638 , but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.(CVE-2018-20969)

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156 .(CVE-2019-13638)

A heap-based out-of-bounds read flaw was found in the way the patch utility parsed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patch files.(CVE-2016-10713)

A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches.(CVE-2018-6952)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has patch packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GNU patch before 2.7.6. Out-     of-bounds access within pch_write_line() in pch.c can     possibly lead to DoS via a crafted input file.
    (CVE-2016-10713)

  - A double free exists in the another_hunk function in     pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Directory traversal vulnerability in GNU patch versions     which support Git-style patching before 2.7.3 allows     remote attackers to write to arbitrary files with the     permissions of the target user via a .. (dot dot) in a     diff file name.(CVE-2015-1395)

  - A double-free flaw was found in the way the patch     utility processed patch files. An attacker could     potentially use this flaw to crash the patch utility by     tricking it into processing crafted     patches.(CVE-2018-6952)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the patch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A double-free flaw was found in the way the patch     utility processed patch files. An attacker could     potentially use this flaw to crash the patch utility by     tricking it into processing crafted     patches.(CVE-2018-6952)

  - Directory traversal vulnerability in GNU patch versions     which support Git-style patching before 2.7.3 allows     remote attackers to write to arbitrary files with the     permissions of the target user via a .. (dot dot) in a     diff file name.(CVE-2015-1395)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for patch is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the changes to their original file (patching the file).

Security Fix(es) :

* patch: Out-of-bounds access in pch_write_line function in pch.c (CVE-2016-10713)

* patch: Double free of memory in pch.c:another_hunk() causes a crash (CVE-2018-6952)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - patch: Out-of-bounds access in pch_write_line function     in pch.c (CVE-2016-10713)

  - patch: Double free of memory in pch.c:another_hunk()     causes a crash (CVE-2018-6952)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2033 advisory.

  - patch: Out-of-bounds access in pch_write_line function in pch.c (CVE-2016-10713)

  - patch: Double free of memory in pch.c:another_hunk() causes a crash (CVE-2018-6952)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201904-17 (Patch: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Patch. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the patch package has been released.

Security fix for CVE-2018-6951 and CVE-2018-6952

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

security fix for CVE-2018-6952

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a 'mangled rename' issue.

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility.
This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

New upstream release, including security fixes for CVE-2016-10713, CVE-2018-6951, CVE-2018-6952.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196246	RHEL 5 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196239	RHEL 6 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
180783	Oracle Linux 7 : patch (ELSA-2019-2033)	Nessus	Oracle Linux Local Security Checks	high
161833	SUSE SLES12 Security Update : patch (SUSE-SU-2022:1932-1)	Nessus	SuSE Local Security Checks	medium
161826	SUSE SLED15 / SLES15 Security Update : patch (SUSE-SU-2022:1925-1)	Nessus	SuSE Local Security Checks	medium
135608	EulerOS Virtualization 3.0.2.2 : patch (EulerOS-SA-2020-1446)	Nessus	Huawei Local Security Checks	high
132496	NewStart CGSL CORE 5.05 / MAIN 5.05 : patch Multiple Vulnerabilities (NS-SA-2019-0253)	Nessus	NewStart CGSL Local Security Checks	high
130282	Amazon Linux AMI : patch (ALAS-2019-1312)	Nessus	Amazon Linux Local Security Checks	high
130214	Amazon Linux 2 : patch (ALAS-2019-1317)	Nessus	Amazon Linux Local Security Checks	high
129931	NewStart CGSL CORE 5.04 / MAIN 5.04 : patch Multiple Vulnerabilities (NS-SA-2019-0205)	Nessus	NewStart CGSL Local Security Checks	high
129197	EulerOS 2.0 SP3 : patch (EulerOS-SA-2019-2004)	Nessus	Huawei Local Security Checks	high
128915	EulerOS 2.0 SP2 : patch (EulerOS-SA-2019-1863)	Nessus	Huawei Local Security Checks	high
128844	EulerOS Virtualization for ARM 64 3.0.2.0 : patch (EulerOS-SA-2019-1922)	Nessus	Huawei Local Security Checks	high
128334	CentOS 7 : patch (CESA-2019:2033)	Nessus	CentOS Local Security Checks	high
128249	Scientific Linux Security Update : patch on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
128093	EulerOS 2.0 SP5 : patch (EulerOS-SA-2019-1801)	Nessus	Huawei Local Security Checks	high
127652	RHEL 7 : patch (RHSA-2019:2033)	Nessus	Red Hat Local Security Checks	high
124130	GLSA-201904-17 : Patch: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
121998	Photon OS 2.0: Patch PHSA-2018-2.0-0102	Nessus	PhotonOS Local Security Checks	high
121891	Photon OS 1.0: Patch PHSA-2018-1.0-0189	Nessus	PhotonOS Local Security Checks	high
120761	Fedora 28 : patch (2018-c255f16bfe)	Nessus	Fedora Local Security Checks	high
120616	Fedora 29 : patch (2018-90af6f5b8a)	Nessus	Fedora Local Security Checks	high
118902	FreeBSD : patch -- multiple vulnerabilities (791841a3-d484-4878-8909-92ef9ce424f4)	Nessus	FreeBSD Local Security Checks	high
118245	Fedora 27 : patch (2018-d547a126e7)	Nessus	Fedora Local Security Checks	high
106915	Fedora 27 : patch (2018-b127e58641)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-6952

high

Tenable Plugins

high

medium

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high