OESA-2026-4619

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4619

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4619.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4619

Upstream

CVE-2026-115207

Published

2026-10-29T09:03:40Z

Modified

2026-10-29T09:15:39Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

patch security update

Details

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.

Security Fix(es):

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)

Database specific

{
    "severity":  "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP3 / patch

Package

Name: patch
Purl: pkg:rpm/openEuler/patch&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.6-24.oe2403sp3

Ecosystem specific

{
    "aarch64":  [
        "patch-2.7.6-24.oe2403sp3.aarch64.rpm",
        "patch-debuginfo-2.7.6-24.oe2403sp3.aarch64.rpm",
        "patch-debugsource-2.7.6-24.oe2403sp3.aarch64.rpm"
    ],
    "noarch":  [
        "patch-help-2.7.6-24.oe2403sp3.noarch.rpm"
    ],
    "src":  [
        "patch-2.7.6-24.oe2403sp3.src.rpm"
    ],
    "x86_64":  [
        "patch-2.7.6-24.oe2403sp3.x86_64.rpm",
        "patch-debuginfo-2.7.6-24.oe2403sp3.x86_64.rpm",
        "patch-debugsource-2.7.6-24.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4619.json"