CVE-2019-13636
Summary
| CVE | CVE-2019-13636 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-07-17 21:15:00 UTC |
| Updated | 2023-11-07 03:03:00 UTC |
| Description | In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. |
Risk And Classification
Problem Types: CWE-59
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| patch.git - GNU patch | MISC | git.savannah.gnu.org | Mailing List, Patch, Vendor Advisory |
| [SECURITY] Fedora 30 Update: patch-2.7.6-11.fc30 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| August 2019 GNU patch Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Debian -- Security Information -- DSA-4489-1 patch | DEBIAN | www.debian.org | |
| Bugtraq: Details about recent GNU patch vulnerabilities | BUGTRAQ | seclists.org | |
| [SECURITY] [DLA 1856-1] patch security update | MLIST | lists.debian.org | Third Party Advisory |
| Bugtraq: [SECURITY] [DSA 4489-1] patch security update | BUGTRAQ | seclists.org | |
| GitHub - irsl/gnu-patch-vulnerabilities: The GNU patch utility was prone vulnerable to multiple attacks through version 2.7.6. You can find my related PoC files here. | MISC | github.com | |
| USN-4071-1: Patch vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | |
| USN-4071-2: Patch vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| [SECURITY] Fedora 30 Update: patch-2.7.6-11.fc30 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| Patch: Multiple vulnerabilities (GLSA 201908-22) — Gentoo security | GENTOO | security.gentoo.org | |
| GNU patch Command Injection / Directory Traversal ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296079 Oracle Solaris 11.4 Support Repository Update (SRU) 15.5.0 Missing (CPUOCT2019)
- 377385 Alibaba Cloud Linux Security Update for patch (ALINUX3-SA-2022:0056)
- 500512 Alpine Linux Security Update for patch
- 504271 Alpine Linux Security Update for patch
- 752201 SUSE Enterprise Linux Security Update for patch (SUSE-SU-2022:1925-1)
- 752207 SUSE Enterprise Linux Security Update for patch (SUSE-SU-2022:1932-1)
- 900088 CBL-Mariner Linux Security Update for patch 2.7.6
- 901458 Common Base Linux Mariner (CBL-Mariner) Security Update for patch (6789-1)
- 903458 Common Base Linux Mariner (CBL-Mariner) Security Update for patch (1915)
- 940038 AlmaLinux Security Update for patch (ALSA-2020:1852)
- 960198 Rocky Linux Security Update for patch (RLSA-2020:1852)