Double Free Vulnerability in GNU Patch Package: CVE-2018-6952
Summary
UBUNTU-CVE-2018-6952: A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Affects patch versions 2.7.1-3 – 2.7.1-4ubuntu2.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The GNU Patch package is a widely used utility that allows users to apply changes to files and directories based on diff files. It is essential for managing source code changes and is commonly utilized in software development environments. The package is known for its ability to handle patches efficiently, but it has been found to have a critical vulnerability that can lead to severe consequences if not addressed.
Vulnerability Detail
A double free vulnerability exists in the another_hunk function within the pch.c file of GNU Patch versions up to 2.7.6. This flaw can be exploited by an attacker to manipulate memory, potentially leading to arbitrary code execution or crashing the application. The vulnerability arises from improper memory management, where the same memory location is freed multiple times, causing instability and security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of the GNU Patch package until the update is applied. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The double free vulnerability in the GNU Patch package (CVE-2018-6952) poses significant risks to users and applications. It is essential to update to the latest version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for patch →
FAQ
CVE-2018-6952 is a unique identifier for a specific vulnerability in the GNU Patch package that allows for a double free condition, potentially leading to memory corruption.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploiting this vulnerability can lead to arbitrary code execution, application crashes, and other security risks, making it crucial to address promptly.
While the best course of action is to update the package, avoiding the use of the affected functionalities can serve as a temporary mitigation strategy.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
