Out-of-Bounds Access Vulnerability in GNU Patch Package - CVE-2016-10713
Summary
DEBIAN-CVE-2016-10713: An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. Affects patch versions < 2.7.6-1. Fixed in 2.7.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The GNU Patch package is a widely used utility that allows users to apply changes to files and manage patches in software development. It is essential for maintaining code integrity and facilitating updates. However, prior to version 2.7.6, it was found to have a critical vulnerability that could lead to severe consequences if exploited.
Vulnerability Detail
An issue was discovered in GNU Patch before version 2.7.6, specifically within the pch_write_line() function in pch.c. This vulnerability allows for out-of-bounds access, which can potentially lead to a Denial of Service (DoS) when a crafted input file is processed. The flaw arises from improper handling of input data, making it susceptible to malicious exploitation.
How To Fix
Minimum fixed version
2.7.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or crafted input files that may exploit this vulnerability until the package is updated.
Conclusion
The GNU Patch package has a critical vulnerability (CVE-2016-10713) that can lead to Denial of Service through out-of-bounds access. Users are advised to update to version 2.7.6-1 or later to mitigate this risk. Until then, caution should be exercised when handling input files.
See every vulnerability recorded for patch →
FAQ
CVE-2016-10713 is a vulnerability identifier for an out-of-bounds access issue found in the GNU Patch package before version 2.7.6.
Exploitation of this vulnerability can lead to Denial of Service (DoS), causing the application to crash or become unresponsive.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, refrain from using untrusted input files that could exploit the vulnerability.
More information about GNU Patch can be found in its official documentation and repositories, which detail its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
