Description
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | patch | 2.7.6-2 | — |
| Debian 13 | patch | 2.7.6-2 | — |
| Debian 12 | patch | 2.7.6-2 | — |
| Debian 7 | patch | 2.6.1-3+deb7u1 | DLA-1348-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | patch | 2.7.5-1ubuntu0.16.04.1 | USN-3624-1 |
| Ubuntu 14.04 LTS | patch | 2.7.1-4ubuntu2.4 | USN-3624-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | patch | 2.7.1-10.el7_5 | RHSA-2018:1200 |
| RHEL 6 | patch | 2.6-8.el6_9 | RHSA-2018:1199 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.4 EUS | patch | 2.7.1-10.el7_4 | RHSA-2018:2091 |
| RHEL 7.3 EUS | patch | 2.7.1-10.el7_3 | RHSA-2018:2092 |
| RHEL 7.2 TUS | patch | 2.7.1-10.el7_2 | RHSA-2018:2093 |
| RHEL 7.2 E4S | patch | 2.7.1-10.el7_2 | RHSA-2018:2093 |
| RHEL 7.2 AUS | patch | 2.7.1-10.el7_2 | RHSA-2018:2093 |
| RHEL 6.7 EUS | patch | 2.6-8.el6_7 | RHSA-2018:2094 |
| RHEL 6.6 TUS | patch | 2.6-8.el6_6 | RHSA-2018:2095 |
| RHEL 6.6 AUS | patch | 2.6-8.el6_6 | RHSA-2018:2095 |
| RHEL 6.5 AUS | patch | 2.6-8.el6_5 | RHSA-2018:2096 |
| RHEL 6.4 AUS | patch | 2.6-8.el6_4 | RHSA-2018:2097 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | patch | 2.7.5-8.5.1 | SUSE-SU-2018:1128-1 |
| SLES 11 SP4 | patch | 2.5.9-252.22.7.1 | SUSE-SU-2018:1162-1 |
| SLES 11 SP3 | patch | 2.5.9-252.22.7.1 | SUSE-SU-2018:1162-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | patch | 2.7.5-8.5.1 | SUSE-SU-2018:1128-1 |
| SLES for SAP 11 SP4 | patch | 2.5.9-252.22.7.1 | SUSE-SU-2018:1162-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | patch | 2.5.9-252.22.7.1 | SUSE-SU-2018:1162-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | patch | 2.7.6-3.43 | openSUSE-SU-2024:11151-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | patch | 2.7.6-r6 | — |
| Alpine v3.23 | patch | 2.7.6-r6 | — |
| Alpine v3.22 | patch | 2.7.6-r6 | — |
| Alpine v3.21 | patch | 2.7.6-r6 | — |
| Alpine v3.20 | patch | 2.7.6-r6 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | patch | 2.7.6-r6 | — |
| Alpine v3.18 | patch | 2.7.6-r6 | — |
| Alpine v3.17 | patch | 2.7.6-r6 | — |
| Alpine v3.16 | patch | 2.7.6-r6 | — |
| Alpine v3.15 | patch | 2.7.6-r6 | — |
| Alpine v3.14 | patch | 2.7.6-r6 | — |
| Alpine v3.13 | patch | 2.7.6-r6 | — |
| Alpine v3.12 | patch | 2.7.6-r6 | — |
| Alpine v3.11 | patch | 2.7.6-r6 | — |
| Alpine v3.10 | patch | 2.7.6-r6 | — |
| Alpine v3.9 | patch | 2.7.6-r6 | — |
| Alpine v3.8 | patch | 2.7.6-r4 | — |
| Alpine v3.7 | patch | 2.7.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | patch | 2.7.1-10.amzn2 | ALAS2-2018-1008 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | patch | 2.7.6-9 | — |
| Azure Linux 2 (CBL-Mariner) | patch | 2.7.6-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | patch | 2.7.1-10.el7_5 | ELSA-2018-1200 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | patch | 2.7.6-r3 | — |
Advisories 17
- RHSA-2018:2094 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2018:2091 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2018:2092 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2018:1200 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2018:1199 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-1348-1 patch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3624-1 patch vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2018:1162-1 Security update for patch SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11151-1 patch-2.7.6-3.43 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2018:2097 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2018:2096 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2018:2095 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2018:2093 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- VDE-2025-053 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jul 8, 2025
- SUSE-SU-2018:1128-1 Security update for patch SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2018-1008 Important: patch security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 10, 2018
- ELSA-2018-1200 Important: patch security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 23, 2018
References
- https://savannah.gnu.org/bugs/index.php?53566
- [debian-lts-announce] 20180416 [SECURITY] [DLA 1348-1] patch security update mailing-list
- USN-3624-2 vendor-advisory
- USN-3624-1 vendor-advisory
- http://rachelbythebay.com/w/2018/04/05/bangpatch/
- RHSA-2018:2091 vendor-advisory
- RHSA-2018:2094 vendor-advisory
- RHSA-2018:2093 vendor-advisory
- RHSA-2018:1200 vendor-advisory
- RHSA-2018:2095 vendor-advisory
- RHSA-2018:1199 vendor-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19
- RHSA-2018:2092 vendor-advisory
- RHSA-2018:2097 vendor-advisory
- RHSA-2018:2096 vendor-advisory
- GLSA-201904-17 vendor-advisory
- 20190730 [SECURITY] [DSA 4489-1] patch security update mailing-list
- 20190816 Details about recent GNU patch vulnerabilities mailing-list
- http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
- https://web.archive.org/web/20180405231329/https://twitter.com/kurtseifried/status/982028968877436928