CVE-2019-13636: Medium severity GNU patch vulnerability
Published Jul 17, 2019
·Updated
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Affected Software
3 affected componentsFixes available
debian/patch<=2.7.6-4, <=2.7.6-3
2.7.6-52.7.6-3+deb10u12.7.5-1+deb9u2
GNU patch<=2.7.6
debian/patch
2.7.6-72.8-22.8.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/patchto a version that resolves this vulnerability.Fixed in 2.7.6-5Fixed in 2.7.6-3+deb10u1Fixed in 2.7.5-1+deb9u2 - Upgrade
Upgrade
debian/patchto a version that resolves this vulnerability.Fixed in 2.7.6-7Fixed in 2.8-2Fixed in 2.8.1-1
Event History
Jul 17, 2019
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·08:04 PM
Data Sourced
via MITRE·08:04 PM
Description
Data Sourced
via NVD·09:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·09:15 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2019-13636?
CVE-2019-13636 has been rated as medium severity due to mishandling of symlinks in GNU patch.
2
How do I fix CVE-2019-13636?
To fix CVE-2019-13636, upgrade GNU patch to version 2.7.6-7 or later.
3
What versions are affected by CVE-2019-13636?
CVE-2019-13636 affects GNU patch versions up to and including 2.7.6.
4
Which software is impacted by CVE-2019-13636?
CVE-2019-13636 impacts GNU patch software, particularly versions prior to 2.7.6.
5
Is CVE-2019-13636 specific to any operating system?
CVE-2019-13636 is primarily noted in Debian distributions using affected versions of GNU patch.