Important: patch security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13638: GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. 99999: CVE-2019-13638 patch: OS shell command injection when processing crafted patch files CVE-2018-6952: A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches. 99999: CVE-2018-6952 patch: Double free of memory in pch.c:another_hunk() causes a crash CVE-2018-20969: do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter. 99999: CVE-2018-20969 patch: do_ed_script in pch.c does not block strings beginning with a ! character CVE-2016-10713: A heap-based out-of-bounds read flaw was found in the way the patch utility parsed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patch files. 99999: CVE-2016-10713 patch: Out-of-bounds access in pch_write_line function in pch.c