Patch
CVE-2019-13636
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
AnalysisAI
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Technical ContextAI
This vulnerability is classified under CWE-59. In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. Affected products include: Gnu Patch. Version information: through 2.7.6.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an exce
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting i
Tanium addressed an improper access controls vulnerability in Patch. [CVSS 4.3 MEDIUM]
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today