Lucene search

K
rosalinuxROSA LABROSA-SA-2021-1946
HistoryJul 02, 2021 - 5:39 p.m.

Advisory ROSA-SA-2021-1946

2021-07-0217:39:56
ROSA LAB
abf.rosalinux.ru
2

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:C/A:N

0.035 Low

EPSS

Percentile

91.3%

Software: path 2.7.1
OS: Cobalt 7.9

CVE-ID: CVE-2014-9637
CVE-Crit: MEDIUM
CVE-DESC: GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation error) with a crafted diff file.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2015-1196
CVE-Crit: CRITICAL
CVE-DESC: GNU patch 2.7.1 allows remote attackers to write to arbitrary files using a symbolic link attack in the patch file.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2015-1395
CVE-Crit: HIGH
CVE-DESC: A directory traversal vulnerability in GNU patch versions that support Git-style patching prior to 2.7.3 allows remote attackers to write to arbitrary files with the target user’s permissions via … (dot-dot-dot) in the diff filename.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2015-1396
CVE-Crit: HIGH
CVE-DESC: There is a directory traversal vulnerability in the GNU patch to 2.7.4. A remote attacker can write to arbitrary files using a symbolic link attack in the patch file. NOTE: this issue occurs due to an incomplete patch for CVE-2015-1196.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-6951
CVE-Crit: HIGH
CVE-DESC: The issue was discovered in the GNU patch to 2.7.6. There is a segmentation error related to dereferencing a NULL pointer, causing a denial of service in the intuit_diff_type function in pch.c, also known as the “garbled rename” problem.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-13636
CVE-Crit: MEDIUM
CVE-DESC: In the GNU patch to 2.7.6, the following symbolic links are incorrectly handled in some cases other than input files. This affects inp.c and util.c.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-20633
CVE-Crit: MEDIUM
CVE-DESC: The GNU patch to 2.7.6 contains a Double Free (p_line [p_end]) vulnerability in the another_hunk function in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue occurs due to an incomplete patch for CVE-2018-6952.
CVE-STATUS: default
CVE-REV: default

OSVersionArchitecturePackageVersionFilename
Cobaltanynoarchpath< 2.7.1UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.5 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:C/A:N

0.035 Low

EPSS

Percentile

91.3%