Directory Traversal Vulnerability in GNU Patch Package
Summary
DEBIAN-CVE-2015-1395: Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. Affects patch versions < 2.7.3-1. Fixed in 2.7.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Patch package is a widely used utility that allows users to apply changes to files and directories based on diff files. It is an essential tool for developers and system administrators, enabling efficient management of code changes and updates. However, certain versions of this package are vulnerable to a directory traversal issue that can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2015-1395 is a directory traversal flaw in GNU Patch versions that support Git-style patching prior to version 2.7.3. This vulnerability allows remote attackers to manipulate diff file names using a '..' (dot dot) sequence, potentially leading to unauthorized file writes with the permissions of the target user. This can result in significant security risks, including data corruption or unauthorized access to sensitive files.
How To Fix
Minimum fixed version
2.7.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted diff files that may contain malicious content. Additionally, implementing strict file permission settings can help limit the potential impact of this vulnerability.
Conclusion
The directory traversal vulnerability in the GNU Patch package poses significant security risks, allowing attackers to exploit the flaw to write to arbitrary files. Users are strongly advised to update to the patched version 2.7.3-1 or later to protect their systems. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for patch →
FAQ
CVE-2015-1395 is a directory traversal vulnerability in the GNU Patch package that allows attackers to write to arbitrary files.
GNU Patch versions prior to 2.7.3 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized file access, data corruption, and potential exploitation of the system by attackers.
Yes, avoid processing untrusted diff files and implement strict file permission settings to limit the impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
