In GNU patch up to and including 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Synopsis
Moderate: patch security and bug fix update
Type/Severity
Security Advisory: Moderate
Topic
An update for patch is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis
Moderate: OpenShift Container Platform 461 image security update
Type/Severity
Security Advisory: Moderate
Topic
An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
Imre Rad discovered several vulnerabilities in GNU patch, leading to
shell command injection or escape from the working directory and access
and overwrite files, if specially crafted patch files are processed
This update includes a bugfix for a regression introduced by the patch
to address CVE-2018-1000156 when applying an ed-style patch (#933140) ...
In GNU patch through 276, the following of symlinks is mishandled in certain cases other than input files This affects inpc and utilc (CVE-2019-13636) ...
The GNU patch utility was prone vulnerable to multiple attacks through version 2.7.6. You can find my related PoC files here.
GNU patch vulnerabilities
I identified several vulnerabilities in the GNU patch utility, some of them making it possible to execute
arbitrary code if the victim opens a crafted patch file It also turned out, some of these vulnerabilities
had been silently addressed by the maintainer back then in 2018 when CVE-2018-1000156 was reported by
pushing some additional commits the sam
Vulmon