NetSight
IP …
high7.8

CVE-2018-1000156

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can resul…

Impact

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

Affected products

VendorProductAffected versions
GnuPatch
Version 2.7.6
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10
DebianDebian Linux
Version 7.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.4, 6.5, 6.6, 7.2, 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 6.7, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.2, 7.3, 7.4, 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-20

References