CVE-2019-20633: Double Free
GNU patch through 2.7.6 contains a free(pline[pend]) Double Free vulnerability in the function anotherhunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.6-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.6-8
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20633?
CVE-2019-20633 is classified as a moderate severity vulnerability.
How do I fix CVE-2019-20633?
To fix CVE-2019-20633, upgrade GNU patch to version 2.7.7 or later.
What type of vulnerability is CVE-2019-20633?
CVE-2019-20633 is a Double Free vulnerability that can lead to denial of service.
What is the impact of CVE-2019-20633?
The impact of CVE-2019-20633 includes potential denial of service when processing a crafted patch file.
Which versions of GNU patch are affected by CVE-2019-20633?
GNU patch versions up to and including 2.7.6 are affected by CVE-2019-20633.