The remote host is affected by the vulnerability described in GLSA-201904-17 (Patch: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Patch. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for patch fixes the following issues: Security issues fixed :

  - CVE-2018-1000156: Malicious patch files cause ed to     execute arbitrary commands (bsc#1088420).

  - CVE-2018-6951: Fixed NULL pointer dereference in the     intuit_diff_type function in pch.c (bsc#1080918).

  - CVE-2016-10713: Fixed out-of-bounds access within     pch_write_line() in pch.c (bsc#1080918).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the patch package has been released.

According to the version of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in GNU patch through 2.7.6.
    There is a segmentation fault, associated with a NULL     pointer dereference, leading to a denial of service in     the intuit_diff_type function in pch.c, aka a 'mangled     rename' issue.(CVE-2018-6951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for patch fixes the following issues :

Security issues fixed :

  - CVE-2018-1000156: Malicious patch files cause ed to     execute arbitrary commands (bsc#1088420).

  - CVE-2018-6951: Fixed NULL pointer dereference in the     intuit_diff_type function in pch.c (bsc#1080918).

  - CVE-2016-10713: Fixed out-of-bounds access within     pch_write_line() in pch.c (bsc#1080918).

This update was imported from the SUSE:SLE-12:Update update project.

It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this to cause a denial of service.
(CVE-2016-10713)

It was discovered that Patch incorrectly handled certain input validation. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000156)

It was discovered that Patch incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service.
(CVE-2018-6951).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release, including security fixes for CVE-2016-10713, CVE-2018-6951, CVE-2018-6952.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-6951 and CVE-2018-6952

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a 'mangled rename' issue.

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility.
This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

According to the version of the patch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference flaw was found in the way     patch processed patch files. An attacker could     potentially use this flaw to crash patch by tricking it     into processing crafted patches.(CVE-2018-6951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
124130	GLSA-201904-17 : Patch: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/18/2019	9/24/2019	high
109549	SUSE SLED12 / SLES12 Security Update : patch (SUSE-SU-2018:1128-1)	Nessus	SuSE Local Security Checks	5/3/2018	9/24/2019	high
121826	Photon OS 1.0: Patch PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	2/7/2019	5/24/2022	high
149136	EulerOS 2.0 SP3 : patch (EulerOS-SA-2021-1827)	Nessus	Huawei Local Security Checks	4/30/2021	1/3/2024	high
109540	openSUSE Security Update : patch (openSUSE-2018-416)	Nessus	SuSE Local Security Checks	5/3/2018	1/19/2021	high
109002	Ubuntu 14.04 LTS / 16.04 LTS : Patch vulnerabilities (USN-3624-1)	Nessus	Ubuntu Local Security Checks	4/11/2018	10/23/2023	high
106915	Fedora 27 : patch (2018-b127e58641)	Nessus	Fedora Local Security Checks	2/21/2018	1/6/2021	high
118245	Fedora 27 : patch (2018-d547a126e7)	Nessus	Fedora Local Security Checks	10/22/2018	1/6/2021	high
120761	Fedora 28 : patch (2018-c255f16bfe)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	high
118902	FreeBSD : patch -- multiple vulnerabilities (791841a3-d484-4878-8909-92ef9ce424f4)	Nessus	FreeBSD Local Security Checks	11/13/2018	11/8/2019	high
131508	EulerOS Virtualization for ARM 64 3.0.3.0 : patch (EulerOS-SA-2019-2343)	Nessus	Huawei Local Security Checks	12/3/2019	4/8/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high