PT-2014-1974 · Gnu+3 · Gnu Patch+3

Gcs + 1 · Publicado 2014-12-31 · Atualizado 2018-05-07 · CVE-2014-9637

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU patch versions 2.7.2 and earlier

Description The issue is related to errors in resource management, specifically memory consumption, which can lead to a denial of service. This can be triggered by a remote attacker using a crafted diff file, resulting in a segmentation fault. The estimated number of potentially affected devices is not specified.

Recommendations For GNU patch versions 2.7.2 and earlier, update to a version later than 2.7.2 to resolve the issue. As a temporary workaround, consider restricting the use of crafted diff files to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2015-1846

BDU:2017-02048

CVE-2014-9637

MGASA-2015-0068

SUSE-SU-2018:1162-1

USN-2651-1

Produtos afetados

Alt Linux

Gnu Patch

Suse

Ubuntu

Referências · 48

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651 · Nota de Segurança
• https://suse.com/support/update/announcement/2018/suse-su-20181162-1 · Nota
• https://git.savannah.gnu.org/cgit/patch.git/commit/?id=0c08d7a902c6fdd49b704623a12d8d672ef18944 · Correção
• https://ubuntu.com/security/CVE-2014-9637 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227 · Nota
• https://savannah.gnu.org/bugs/?44051 · Correção
• http://ubuntu.com/usn/USN-2651-1 · Correção, Aviso do Fabricante
• https://ubuntu.com/security/CVE-2010-4651 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-9637 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-9637 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-9637 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1185262 · Correção
• https://suse.com/security/cve/CVE-2010-4651 · Nota
• https://bugzilla.suse.com/662957 · Nota
• https://osv.dev/vulnerability/CVE-2014-9637 · Aviso do Fabricante