CVE-2015-1395
Fixed in a distro release EPSS 11%
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Products: fedoraproject fedora, canonical ubuntu_linux, gnu patch
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | patch | 2.7.3-1 |
| Debian 13 | patch | 2.7.3-1 |
| Debian 14 | patch | 2.7.3-1 |
| SUSE Linux Enterprise Desktop 12 | patch | 2.7.5-7.1 |
| SUSE Linux Enterprise Server 12 | patch | 2.7.5-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | patch | 2.7.5-7.1 |
| Ubuntu 14.04 LTS | patch | 2.7.1-4ubuntu2.3 |