Description
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | patch | 2.5-1 | — |
| Debian 13 | patch | 2.5-1 | — |
| Debian 12 | patch | 2.5-1 | — |
References
- [oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1) mailing-list
- [oss-security] 20150730 CVE-2015-1416: vulnerability in patch(1) mailing-list
- [oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1) mailing-list
- FreeBSD-SA-15:14 vendor-advisory
- 1033110 vdb-entry
- 76116 vdb-entry
- [oss-security] 20150802 Re: CVE-2015-1416: vulnerability in patch(1) mailing-list