CVE-2019-13636: Medium severity GNU patch vulnerability
Published Jul 17, 2019
·Updated
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Affected Software
3 affected componentsFixes available
debian/patch<=2.7.6-4, <=2.7.6-3
2.7.6-52.7.6-3+deb10u12.7.5-1+deb9u2
GNU patch<=2.7.6
debian/patch
2.7.6-72.8-2
Remediation
Event History
Jul 17, 2019
CVE Published
via MITRE·08:04 PM
Data Sourced
via MITRE·08:04 PM
Description
Data Sourced
via NVD·09:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·11:03 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·11:03 PM
DescriptionAffected Software
Data Sourced
via Launchpad·11:03 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-13636?
CVE-2019-13636 has been rated as medium severity due to mishandling of symlinks in GNU patch.
2
How do I fix CVE-2019-13636?
To fix CVE-2019-13636, upgrade GNU patch to version 2.7.6-7 or later.
3
What versions are affected by CVE-2019-13636?
CVE-2019-13636 affects GNU patch versions up to and including 2.7.6.
4
Which software is impacted by CVE-2019-13636?
CVE-2019-13636 impacts GNU patch software, particularly versions prior to 2.7.6.
5
Is CVE-2019-13636 specific to any operating system?
CVE-2019-13636 is primarily noted in Debian distributions using affected versions of GNU patch.