Security fix for CVE-2018-6951 and CVE-2018-6952

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD による報告：

2.7.6によりGNUパッチで問題が発見されました。NULLポインターデリファレンスに関連するセグメンテーション違反があり、pch.cのintuit_diff_type関数でサービス拒否を引き起こします。これは別名「マングルされた名前の変更」の問題です。

2.7.6により、二重解放がGNUパッチのpch.cのanother_hunk関数に存在します。

GNU Patchバージョン2.7.6には、パッチファイルの処理時に入力検証の脆弱性があります。特に、EDITOR_PROGRAMの呼び出し（edを使用）によりコードが実行される可能性があります。この攻撃は、パッチユーティリティで処理されたパッチファイルを介して悪用される可能性があります。
これは、FreeBSDのCVE-2015-1418と同様ですが、共通祖先を共有しているものの、コードベースは時間の経過と共に異なっていきます。

CVE-2018-6951とCVE-2018-6952のセキュリティ修正

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

セキュリティ修正プログラム:

  - パッチ：pch.cのpch_write_line関数における領域外アクセス（CVE-2016-10713）

  - パッチ：pch.c:another_hunk()の二重解放によりクラッシュが発生します（CVE-2018-6952）

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  2.7.6 までの GNU パッチで、pch.c の another_hunk 関数に二重解放が存在します。(CVE-2018-6952)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has patch packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GNU patch before 2.7.6. Out-     of-bounds access within pch_write_line() in pch.c can     possibly lead to DoS via a crafted input file.
    (CVE-2016-10713)

  - A double free exists in the another_hunk function in     pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - GNU patch through 2.7.6 is vulnerable to OS shell     command injection that can be exploited by opening a     crafted patch file that contains an ed style diff     payload with shell metacharacters. The ed editor does     not need to be present on the vulnerable system. This is     different from CVE-2018-1000156. (CVE-2019-13638)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does     not block strings beginning with a ! character. NOTE:
    this is the same commit as for CVE-2019-13638, but the !     syntax is specific to ed, and is unrelated to a shell     metacharacter. (CVE-2018-20969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the patch package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free exists in the another_hunk function in     pch.c in GNU patch through 2.7.6.(CVE-2018-6952)

  - Directory traversal vulnerability in GNU patch versions     which support Git-style patching before 2.7.3 allows     remote attackers to write to arbitrary files with the     permissions of the target user via a .. (dot dot) in a     diff file name.(CVE-2015-1395)

  - An issue was discovered in GNU patch before 2.7.6.
    Out-of-bounds access within pch_write_line() in pch.c     can possibly lead to DoS via a crafted input     file.(CVE-2016-10713)

  - GNU patch 2.7.2 and earlier allows remote attackers to     cause a denial of service (memory consumption and     segmentation fault) via a crafted diff     file.(CVE-2014-9637)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2015-1196)

  - GNU patch through 2.7.6 is vulnerable to OS shell     command injection that can be exploited by opening a     crafted patch file that contains an ed style diff     payload with shell metacharacters. The ed editor does     not need to be present on the vulnerable system. This     is different from CVE-2018-1000156.(CVE-2019-13638)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does     not block strings beginning with a ! character. NOTE:
    this is the same commit as for CVE-2019-13638, but the     ! syntax is specific to ed, and is unrelated to a shell     metacharacter.(CVE-2018-20969)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the patch package has been released.

According to the versions of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Directory traversal vulnerability in GNU patch versions     which support Git-style patching before 2.7.3 allows     remote attackers to write to arbitrary files with the     permissions of the target user via a .. (dot dot) in a     diff file name.(CVE-2015-1395)

  - A double-free flaw was found in the way the patch     utility processed patch files. An attacker could     potentially use this flaw to crash the patch utility by     tricking it into processing crafted     patches.(CVE-2018-6952)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of patch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2018-6952 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of 'patch' packages of Photon OS has been released.

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638 , but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.(CVE-2018-20969)

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156 .(CVE-2019-13638)

A heap-based out-of-bounds read flaw was found in the way the patch utility parsed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patch files.(CVE-2016-10713)

A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches.(CVE-2018-6952)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1925-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118245	Fedora 27 : patch (2018-d547a126e7)	Nessus	Fedora Local Security Checks	2018/10/22	2024/7/30	high
120761	Fedora 28 : patch (2018-c255f16bfe)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	high
118902	FreeBSD: patch -- 複数の脆弱性（791841a3-d484-4878-8909-92ef9ce424f4）	Nessus	FreeBSD Local Security Checks	2018/11/13	2024/7/23	high
118245	Fedora 27：パッチ（2018-d547a126e7）	Nessus	Fedora Local Security Checks	2018/10/22	2024/7/30	high
120761	Fedora 28：パッチ（2018-c255f16bfe）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	high
128249	Scientific Linux セキュリティ更新: SL7.x x86_64のパッチ（20190806）	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	high
221829	Linux Distros のパッチ未適用の脆弱性: CVE-2018-6952	Nessus	Misc.	2025/3/4	2025/9/15	high
132496	NewStart CGSL CORE 5.05 / MAIN 5.05 : patch Multiple Vulnerabilities (NS-SA-2019-0253)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2021/1/14	high
135608	EulerOS Virtualization 3.0.2.2 : patch (EulerOS-SA-2020-1446)	Nessus	Huawei Local Security Checks	2020/4/16	2024/3/15	high
233765	Photon OS 5.0: Patch PHSA-2024-5.0-0424	Nessus	PhotonOS Local Security Checks	2025/4/2	2025/4/2	high
129197	EulerOS 2.0 SP3 : patch (EulerOS-SA-2019-2004)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	high
201270	CBL Mariner 2.0 Security Update: patch (CVE-2018-6952)	Nessus	MarinerOS Local Security Checks	2024/7/2	2024/7/2	high
118208	Photon OS 1.0: Patch PHSA-2018-1.0-0189 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/10/18	2019/2/7	high
121998	Photon OS 2.0: Patch PHSA-2018-2.0-0102	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
130214	Amazon Linux 2 : patch (ALAS-2019-1317)	Nessus	Amazon Linux Local Security Checks	2019/10/25	2024/4/17	high
161826	SUSE SLED15 / SLES15 Security Update : patch (SUSE-SU-2022:1925-1)	Nessus	SuSE Local Security Checks	2022/6/3	2025/2/20	medium

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium