Univention Bugzilla – Bug 49926
patch: Multiple issues (4.4)
Last modified: 2019-07-31 13:58:46 CEST
New Debian patch 2.7.5-1+deb9u2 fixes: This update addresses the following issues: * the following of symlinks in inp.c and util.c is mishandled in cases other than input files (CVE-2019-13636) * GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. (CVE-2019-13638)
--- mirror/ftp/4.3/unmaintained/4.3-2/source/patch_2.7.5-1+deb9u1.dsc +++ apt/ucs_4.4-0-errata4.4-1/source/patch_2.7.5-1+deb9u2.dsc @@ -1,3 +1,10 @@ +2.7.5-1+deb9u2 [Fri, 26 Jul 2019 10:58:06 +0000] Laszlo Boszormenyi (GCS) <gcs@debian.org>: + + * Fix CVE-2019-13636: mishandled following of symlinks (closes: #932401). + * Fix CVE-2019-13638: shell command injection. + * Fix CVE-2018-1000156 regression, temporary file leak on failed ed-style + patches (closes: #933140). + 2.7.5-1+deb9u1 [Mon, 16 Apr 2018 20:48:43 +0000] Laszlo Boszormenyi (GCS) <gcs@debian.org>: * Fix CVE-2018-1000156: arbitrary command execution in ed-style patches <http://10.200.17.11/4.4-1/#7515565659067354964>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-1] bef3c3c0ad Bug #49926: patch 2.7.5-1+deb9u2 doc/errata/staging/patch.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) [4.4-1] 9231a78f4e Bug #49926: patch 2.7.5-1+deb9u2 doc/errata/staging/patch.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<http://errata.software-univention.de/ucs/4.4/198.html>