sys-devel/patch-9999 — Security Advisories

▸ GLSA 201908-22 Patch: Multiple vulnerabilities this version unaffected normal local 2019-08-18

Multiple vulnerabilities have been found in Patch, the worst of which could result in the arbitrary execution of code.

Announced: 2019-08-18
Revised: 2019-08-18
Access: local
Bugs: #690136
Advisory: https://security.gentoo.org/glsa/201908-22

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-devel/patch	*	< 2.7.6-r4	>= 2.7.6-r4

Background

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.

Description

Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers referenced below for details.

Impact

A local attacker could pass a specially crafted diff file to Patch, possibly resulting in a Denial of Service condition or arbitrary code execution.

Workaround

There is no known workaround at this time.

Resolution

All Patch users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-devel/patch-2.7.6-r4"

References

▸ GLSA 201904-17 Patch: Multiple vulnerabilities this version unaffected normal remote 2019-04-17

Multiple vulnerabilities have been found in Patch, the worst of which could result in the execution of arbitrary code.

Announced: 2019-04-17
Revised: 2019-04-17
Access: remote
Bugs: #647792 #647794 #652710
Advisory: https://security.gentoo.org/glsa/201904-17

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-devel/patch	*	< 2.7.6-r3	>= 2.7.6-r3

Background

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.

Description

Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Patch users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-devel/patch-2.7.6-r3"

References

▸ GLSA 201612-12 Patch: Denial of service this version unaffected normal local 2016-12-05

Patch is vulnerable to a locally generated Denial of Service condition.

Announced: 2016-12-05
Revised: 2016-12-05
Access: local
Bugs: #538658
Advisory: https://security.gentoo.org/glsa/201612-12

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-devel/patch	*	< 2.7.4	>= 2.7.4

Background

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.

Description

Due to a flaw in Patch, the application can enter an infinite loop when processing a specially crafted diff file.

Impact

A local attacker could pass a specially crafted diff file to Patch, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All patch users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-devel/patch-2.7.4"