CVE-2018-6951

HIGH

GNU Patch < 2.7.6 - NULL Pointer Dereference

Title source: rule

Description

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.

References (5)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/103044

[Patch, Vendor Advisory] https://git.savannah.gnu.org/cgit/patch.git/commit/?id=f290f48a621867084884bfff87f8093c15195e6a

[Issue Tracking, Vendor Advisory] https://savannah.gnu.org/bugs/index.php?53132

[Third Party Advisory] https://usn.ubuntu.com/3624-1/

[Third Party Advisory] https://security.gentoo.org/glsa/201904-17

Scores

CVSS v3 7.5

EPSS 0.1533

EPSS Percentile 94.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-476

Status published

Affected Products (4)

gnu/patch < 2.7.6

canonical/ubuntu_linux

Timeline

Published Feb 13, 2018

Tracked Since Feb 18, 2026