Patch
CVE-2021-45261
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
AnalysisAI
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-763. An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service. Affected products include: Gnu Patch.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated mediu
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an exce
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting i
Tanium addressed an improper access controls vulnerability in Patch. [CVSS 4.3 MEDIUM]
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today