PT-2014-1974 · Gnu+3 · Gnu Patch+3

Gcs + 1 · Published 2014-12-31 · Updated 2018-05-07 · CVE-2014-9637

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU patch versions 2.7.2 and earlier

Description The issue is related to errors in resource management, specifically memory consumption, which can lead to a denial of service. This can be triggered by a remote attacker using a crafted diff file, resulting in a segmentation fault. The estimated number of potentially affected devices is not specified.

Recommendations For GNU patch versions 2.7.2 and earlier, update to a version later than 2.7.2 to resolve the issue. As a temporary workaround, consider restricting the use of crafted diff files to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1846

BDU:2017-02048

CVE-2014-9637

MGASA-2015-0068

SUSE-SU-2018:1162-1

USN-2651-1

Affected Products

Alt Linux

Gnu Patch

Suse

Ubuntu

References · 48

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651 · Security Note
• https://git.savannah.gnu.org/cgit/patch.git/commit/?id=0c08d7a902c6fdd49b704623a12d8d672ef18944 · Patch
• https://ubuntu.com/security/CVE-2014-9637 · Vendor Advisory
• https://savannah.gnu.org/bugs/?44051 · Patch
• https://ubuntu.com/security/CVE-2010-4651 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9637 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9637 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1185262 · Patch
• https://osv.dev/vulnerability/CVE-2014-9637 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1396 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1396 · Security Note
• http://openwall.com/lists/oss-security/2015/01/22/7 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9637 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148953.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9637 · Security Note