GNU patch does not properly sanitize patch files allowing for malicious patches to pass arbitrary shell commands to ed. An attacker could exploit this by tricking a user into applying malicious patches with the patch command.

A double free exists in the anotherhunk function in pch.c in GNU patch through 2.7.6.

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuitdifftype function in pch.c, aka a "mangled rename" issue.