CVE-2015-1396

HIGH

GNU patch <2.7.4 - Path Traversal

Title source: llm

Description

A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.

References (4)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/75358

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2651-1

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=1186764

[Mailing List] http://www.openwall.com/lists/oss-security/2015/01/27/29

Scores

CVSS v3 7.5

EPSS 0.0366

EPSS Percentile 87.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE

CWE-22

Status published

Affected Products (5)

gnu/patch < 2.7.4

debian/debian_linux

Timeline

Published Nov 25, 2019

Tracked Since Feb 18, 2026