Denial of Service Vulnerability in GNU Patch Package (CVE-2014-9637)
Summary
CVE-2014-9637: GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file. Affects patch versions < 2.7.1-7. Fixed in 2.7.1-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a widely used utility that applies changes to files based on differences specified in diff files. It is essential for developers and system administrators to manage file updates efficiently. However, versions 2.7.2 and earlier are susceptible to a vulnerability that can lead to severe memory consumption and segmentation faults when processing crafted diff files.
Vulnerability Detail
The vulnerability identified as CVE-2014-9637 allows remote attackers to exploit GNU Patch by sending specially crafted diff files. This can result in denial of service, causing the application to consume excessive memory and potentially leading to a segmentation fault. The issue arises from inadequate input validation, allowing maliciously crafted input to disrupt normal operations.
How To Fix
Minimum fixed version
2.7.1-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted diff files until they have upgraded to a secure version of the GNU Patch package. Additionally, implementing strict input validation on diff files can help mitigate the risk of exploitation.
Conclusion
CVE-2014-9637 is a significant vulnerability in the GNU Patch package that can lead to denial of service through crafted diff files. Users are advised to upgrade to a secure version to mitigate risks. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to potential issues without requiring code access.
See every vulnerability recorded for patch →
FAQ
CVE-2014-9637 is a vulnerability in GNU Patch that allows remote attackers to cause denial of service through crafted diff files.
GNU Patch versions 2.7.2 and earlier are affected by this vulnerability.
The vulnerability can lead to memory consumption and segmentation faults, causing the application to crash and become unavailable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2014-9637 is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
