AZL-35101
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-35101.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-35101
- Upstream
- Published
- 2018-04-06T13:29:00Z
- Modified
- 2026-04-21T04:27:49.112307Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2018-1000156 affecting package patch for versions less than 2.7.6-9
- Details
-
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
- References