CVE-2015-1418: Infoleak

Published Feb 5, 2018

Updated

The doedscript function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.

Affected Software

2 affected components

FreeBSD FreeBSD=10.1

FreeBSD FreeBSD=10.2

Event History

Feb 5, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1418?

CVE-2015-1418 has been classified as a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2015-1418?

You can fix CVE-2015-1418 by updating to a patched version of GNU patch or FreeBSD that addresses this vulnerability.

What systems are affected by CVE-2015-1418?

CVE-2015-1418 affects GNU patch up to version 2.7.6 and specific versions of FreeBSD including 10.1 and 10.2.

What types of attacks can exploit CVE-2015-1418?

An attacker can exploit CVE-2015-1418 by crafting a malicious patch file that sends arbitrary commands to be executed.

Is there a workaround for CVE-2015-1418 if I cannot update immediately?

Currently, there are no known effective workarounds for CVE-2015-1418, so updating is strongly recommended.