CVE-2019-20633
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function...
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
CVE-2019-20633- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List No score
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
CVE-2019-20633- Updated
- 2026-11-02
EUVDEUVD-2019-11172 No score
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
EUVD-2019-11172- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w88p-xvmw-fxgg No score
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function...
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
GHSA-w88p-xvmw-fxgg- Weakness
- CWE-415
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-20633
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
ALPINE-CVE-2019-20633- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-35107
CVE-2019-20633 affecting package patch 2.7.6-10
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
AZL-35107- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 9 moreShow less
OSVAZL-6791
CVE-2019-20633 affecting package patch 2.7.6-8
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
AZL-6791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2019-20633
CVE-2019-20633 does not affect BellSoft software
- Record
BELL-CVE-2019-20633- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
CVE-2019-20633- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-18
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
JLSEC-2026-18- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20633
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
- Record
UBUNTU-CVE-2019-20633- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVopenSUSE-SU-2024:14239-1 No score
patch-2.7.6-8.1 on GA media
These are all security issues fixed in the patch-2.7.6-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14239-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2704-1 No score
Security update for patch
This update for patch fixes the following issues:
- CVE-2019-20633: Fixed double-free/OOB read in pch.c (bsc#1167721)
- Record
SUSE-SU-2024:2704-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2780-1 No score
Security update for patch
This update for patch fixes the following issues:
- CVE-2019-20633: Fixed double-free/OOB read in pch.c (bsc#1167721)
- Record
SUSE-SU-2024:2780-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20075-1 No score
Security update for patch
This update for patch fixes the following issues:
- CVE-2019-20633: Fix double-free/OOB read in pch.c (bsc#1167721)
- Record
SUSE-SU-2025:20075-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
patchAlpine:v3.11 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.12 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.13 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.14 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.15 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.16 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.17 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.18 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.19 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.20 |
before 2.7.6-r7 | 2.7.6-r7 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
patchAlpine:v3.21 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.22 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.23 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAlpine:v3.24 |
before 2.7.6-r7 | 2.7.6-r7 |
patchAzure Linux:3 |
through 2.7.6-10 | None known |
patchAzure Linux:2 |
through 2.7.6-8 | None known |
patch_jllJulia |
before 2.8.0+0 | 2.8.0+0 |
patchSUSE:Linux Enterprise Server 12 SP5 |
before 2.7.5-8.11.1 | 2.7.5-8.11.1 |
patchSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.7.5-8.11.1 | 2.7.5-8.11.1 |
patchSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 2.7.6-150000.5.6.1 | 2.7.6-150000.5.6.1 |
patchSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 2.7.6-150000.5.6.1 | 2.7.6-150000.5.6.1 |
patchopenSUSE:Leap 15.5 |
before 2.7.6-150000.5.6.1 | 2.7.6-150000.5.6.1 |
patchopenSUSE:Leap 15.6 |
before 2.7.6-150000.5.6.1 | 2.7.6-150000.5.6.1 |
patchSUSE:Linux Micro 6.0 |
before 2.7.6-3.1 | 2.7.6-3.1 |
patchUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.7.1-32.7.1-42.7.1-4ubuntu12.7.1-4ubuntu22.7.1-4ubuntu2.32.7.1-4ubuntu2.42.7.1-4ubuntu2.4+esm1 |
None known |
patchUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.5-12.7.5-1ubuntu0.16.04.12.7.5-1ubuntu0.16.04.2 |
None known |
patchUbuntu:18.04:LTS |
All versions, plus listed versions 2.7.5-1build12.7.6-12.7.6-2ubuntu12.7.6-2ubuntu1.1 |
None known |
patchUbuntu:20.04:LTS |
All versions, plus listed versions 2.7.6-6 |
None known |
patchUbuntu:22.04:LTS |
All versions, plus listed versions 2.7.6-72.7.6-7build12.7.6-7build2 |
None known |
patchUbuntu:24.04:LTS |
All versions, plus listed versions 2.7.6-7build22.7.6-7build3 |
None known |
patchUbuntu:25.10 |
All versions, plus listed versions 2.7.6-7build32.8-12.8-2 |
None known |
patchopenSUSE:Tumbleweed |
before 2.7.6-8.1 | 2.7.6-8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20633 is a medium vulnerability (CVSS 5.5) in Gnu Patch, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in patch 2.7.6-r7.