In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:1852 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1852 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1932-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1925-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:1852 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1852 advisory.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1852 advisory.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the patch package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
(CVE-2019-13636)

According to the version of the patch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the patch package has been released.

The remote host is affected by the vulnerability described in GLSA-201908-22 (Patch: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Patch. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could pass a specially crafted diff file to Patch,       possibly resulting in a Denial of Service condition or arbitrary code       execution.
  Workaround :

    There is no known workaround at this time.

Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed.

This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140).

It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2019-13636)

It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-13638).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Handling of symlinks in patch, a tool to apply a diff file to an original, was wrong in certain cases.

For Debian 8 'Jessie', this problem has been fixed in version 2.7.5-1+deb8u2.

We recommend that you upgrade your patch packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184516	Rocky Linux 8 : patch (RLSA-2020:1852)	Nessus	Rocky Linux Local Security Checks	medium
180982	Oracle Linux 8 : patch (ELSA-2020-1852)	Nessus	Oracle Linux Local Security Checks	medium
161833	SUSE SLES12 Security Update : patch (SUSE-SU-2022:1932-1)	Nessus	SuSE Local Security Checks	medium
161826	SUSE SLED15 / SLES15 Security Update : patch (SUSE-SU-2022:1925-1)	Nessus	SuSE Local Security Checks	medium
157681	AlmaLinux 8 : patch (ALSA-2020:1852)	Nessus	Alma Linux Local Security Checks	medium
145812	CentOS 8 : patch (CESA-2020:1852)	Nessus	CentOS Local Security Checks	medium
143013	RHEL 8 : patch (RHSA-2020:1852)	Nessus	Red Hat Local Security Checks	medium
142347	EulerOS 2.0 SP2 : patch (EulerOS-SA-2020-2378)	Nessus	Huawei Local Security Checks	medium
141749	EulerOS Virtualization 3.0.2.2 : patch (EulerOS-SA-2020-2220)	Nessus	Huawei Local Security Checks	medium
140887	EulerOS 2.0 SP3 : patch (EulerOS-SA-2020-2120)	Nessus	Huawei Local Security Checks	medium
138623	Amazon Linux 2 : patch (ALAS-2020-1457)	Nessus	Amazon Linux Local Security Checks	medium
137985	EulerOS Virtualization 3.0.6.0 : patch (EulerOS-SA-2020-1766)	Nessus	Huawei Local Security Checks	medium
136243	EulerOS Virtualization for ARM 64 3.0.2.0 : patch (EulerOS-SA-2020-1540)	Nessus	Huawei Local Security Checks	medium
135122	EulerOS Virtualization for ARM 64 3.0.6.0 : patch (EulerOS-SA-2020-1335)	Nessus	Huawei Local Security Checks	medium
134808	EulerOS 2.0 SP5 : patch (EulerOS-SA-2020-1317)	Nessus	Huawei Local Security Checks	medium
134005	EulerOS 2.0 SP8 : patch (EulerOS-SA-2020-1171)	Nessus	Huawei Local Security Checks	medium
128739	Photon OS 3.0: Patch PHSA-2019-3.0-0025	Nessus	PhotonOS Local Security Checks	high
128712	Photon OS 2.0: Patch PHSA-2019-2.0-0172	Nessus	PhotonOS Local Security Checks	high
127971	GLSA-201908-22 : Patch: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
127102	Debian DSA-4489-1 : patch - security update	Nessus	Debian Local Security Checks	high
127042	Ubuntu 16.04 LTS / 18.04 LTS : Patch vulnerabilities (USN-4071-1)	Nessus	Ubuntu Local Security Checks	high
126833	Debian DLA-1856-1 : patch security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-13636

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

medium