Out-of-Bounds Access Vulnerability in GNU Patch Package - CVE-2016-10713
Summary
ALPINE-CVE-2016-10713: An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. Affects patch versions < 2.7.5-r3. Fixed in 2.7.5-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Patch package is a widely used utility that allows users to apply changes to files using patch files. It is essential for software development and version control, enabling developers to manage changes efficiently. However, certain versions of this package are vulnerable to an out-of-bounds access issue, which can lead to denial of service (DoS) attacks when processing crafted input files.
Vulnerability Detail
An issue was discovered in GNU Patch before version 2.7.6, specifically within the pch_write_line() function in pch.c. This vulnerability allows for out-of-bounds access, which can potentially lead to a denial of service (DoS) condition when a maliciously crafted input file is processed. The vulnerability is significant as it can disrupt the functionality of applications relying on the patch utility, making them unresponsive or crashing them entirely.
How To Fix
Minimum fixed version
2.7.5-r3
This is the first release that contains the fix.
sudo apk add --upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to avoid processing untrusted or crafted patch files until the package is updated. This can help mitigate the risk of exploitation.
Conclusion
The CVE-2016-10713 vulnerability in the GNU Patch package poses a significant risk of denial of service due to out-of-bounds access. It is crucial for users to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for patch →
FAQ
CVE-2016-10713 is a vulnerability in the GNU Patch package that allows for out-of-bounds access, potentially leading to denial of service.
Versions of GNU Patch prior to 2.7.6 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to denial of service, causing applications that rely on the patch utility to become unresponsive or crash.
Yes, temporarily avoid processing untrusted or crafted patch files until the package is updated to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
