A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade patch | Aug 30, 2017 | Feb 2, 2015 |
| Debian | — | Upgrade patch | Jul 30, 2024 | Nov 25, 2019 |
| Oracle Solaris | — | Upgrade text/gnu-patch to version 2.7.5-0.175.2.13.0.4.0 on Solaris 11.2 | Dec 18, 2019 | Nov 25, 2019 |
| Suse | — | Upgrade patch | Dec 18, 2015 | Jun 9, 2015 |
| Ubuntu | — | Upgrade patch | Nov 8, 2024 | Nov 25, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub