Detections
Analytics
Alpine: multiple patch packages: security update to 2.7.4-r0 (deprecated)
high Tenable Self-Hosted Container Security Plugin ID 401165
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and
segmentation fault) via a crafted diff file. (CVE-2014-9637)
- Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3
allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot
dot) in a diff file name. (CVE-2015-1395)
- A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to
arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix
for CVE-2015-1196. (CVE-2015-1396)
See Also
https://git.alpinelinux.org/aports/commit/?id=30b3ba6cbd409bf5d42dffcf442fa1f6e7867e87
https://git.alpinelinux.org/aports/commit/?id=836b5591850530326923a0bcbbb95c592fa8b6ba
Plugin Details
Severity: High
ID: 401165
Version: Revision 1.25
Type: Local
Published: 8/16/2023
Updated: 7/1/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2015-1395
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2015-1396
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/18/2015
Vulnerability Publication Date: 1/21/2015