Denial of Service Vulnerability in GNU Patch Package
Summary
DEBIAN-CVE-2014-9637: GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file. Affects patch versions < 2.7.1-7. Fixed in 2.7.1-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a utility that allows users to apply changes to files based on differences between file versions. It is widely used in software development for managing changes in source code. The package is essential for developers who need to maintain and update code efficiently. However, it has been found to be vulnerable to a specific issue that can lead to denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9637, affects GNU Patch versions 2.7.2 and earlier. It allows remote attackers to exploit the software by sending a crafted diff file, which can lead to excessive memory consumption and segmentation faults. This can result in the application crashing, thereby denying service to legitimate users. The issue arises from improper handling of certain input files, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.7.1-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted diff files until the package is updated. This can help prevent potential exploitation of the vulnerability while a permanent fix is being implemented.
Conclusion
The GNU Patch package has a critical vulnerability that can lead to denial of service. Users are advised to update to the patched version to secure their systems. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for patch →
FAQ
CVE-2014-9637 is a vulnerability in GNU Patch that allows remote attackers to cause denial of service through crafted diff files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to memory consumption issues and segmentation faults, causing the application to crash and deny service to users.
Yes, the patched version of the GNU Patch package is 2.7.1-7 or later. Users should update to this version to mitigate the risk.
If immediate updates are not possible, avoid processing untrusted diff files as a temporary workaround to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
