Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GNU patch ausnutzen, um Dateien zu manipulieren.
Product
Das Unix-Programm patch manipuliert Quelltext anhand einer Patch-Datei.
Vulnerabilities 1
-
Medium 5.5
Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, …
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#1
Initiale Fassung
References
-
GNU Release Note vom 2026-10-26
https://lists.gnu.org/archive/html/bug-patch/2026-10/msg00014.html
-
GitHub Advisory Database vom 2026-10-26
https://github.com/advisories/GHSA-M74W-H57V-XV36
-
Red Hat Security Advisory RHSA-2026:96215 vom 2026-11-09
https://access.redhat.com/errata/RHSA-2026:96215
-
Oracle Linux Security Advisory ELSA-2026-96215 vom 2026-11-10
https://linux.oracle.com/errata/ELSA-2026-96215.html
-
Rocky Linux Security Advisory RLSA-2026:96215 vom 2026-11-10
https://errata.build.resf.org/RLSA-2026:96215
-
Red Hat Security Advisory RHSA-2026:99161 vom 2026-11-12
https://access.redhat.com/errata/RHSA-2026:99161