DSA-4489: -1 patch -- security update

Published Jul 27, 2019

Updated

Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed.

Affected Software

2 affected components

debian/patch

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GNU patch to a version that resolves this vulnerability.
Patch DSA-4489-1

Event History

Jul 27, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Systems are exposed when they process specially crafted patch files with GNU patch. The affected software entry is debian/patch.

What does an attacker need to exploit the vulnerabilities?

An attacker needs a specially crafted patch file to be processed by GNU patch. Successful exploitation may result in shell command injection or escape from the working directory, allowing access to and overwriting of files.

How can I determine whether a system may be affected?

Review whether GNU patch is installed from the debian/patch package and whether it processes patch files from untrusted or insufficiently validated sources. The provided information does not include affected or fixed package versions.

DSA-4489: -1 patch -- security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerabilities?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerabilities?

How can I determine whether a system may be affected?