Every CVE Search/ Get API key

CVE-2016-10713

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line()...

5.5 MediumFix available

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.56%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
CVE-2016-10713
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
CVE-2016-10713
Updated
2026-11-02
EUVDEUVD-2016-1712 No score

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
EUVD-2016-1712
Updated
2026-11-03
GitHub AdvisoriesGHSA-8m7f-5cc5-rjgp 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line()...

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
GHSA-8m7f-5cc5-rjgp
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2016-10713 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
ALPINE-CVE-2016-10713
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
CVE-2016-10713
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2016-10713 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
DEBIAN-CVE-2016-10713
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2033 3.3

Red Hat Security Advisory: patch security and bug fix update

Record
RHSA-2019:2033
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2016-10713 5.5

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Record
UBUNTU-CVE-2016-10713
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0277 No score

Updated patch packages fix security vulnerabilities

Updated patch package fixes security vulnerabilities:

It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this to cause a denial of service (CVE-2016-10713).

It was discovered that Patch incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service (CVE-2018-6951).

It was discovered that Patch incorrectly handled certain input validation. An attacker could possibly use this to execute arbitrary code (CVE-2018-1000156).

Record
MGASA-2018-0277
Updated
2026-11-02
OSVopenSUSE-SU-2024:11151-1 No score

patch-2.7.6-3.43 on GA media

These are all security issues fixed in the patch-2.7.6-3.43 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11151-1
Updated
2026-11-02
OSVSUSE-SU-2018:1128-1 No score

Security update for patch

This update for patch fixes the following issues:

Security issues fixed:

  • CVE-2018-1000156: Malicious patch files cause ed to execute arbitrary commands (bsc#1088420).
  • CVE-2018-6951: Fixed NULL pointer dereference in the intuit_diff_type function in pch.c (bsc#1080918).
  • CVE-2016-10713: Fixed out-of-bounds access within pch_write_line() in pch.c (bsc#1080918).
Record
SUSE-SU-2018:1128-1
Updated
2026-11-02
OSVSUSE-SU-2018:1162-1 No score

Security update for patch

This update for patch fixes several issues.

These security issues were fixed:

  • CVE-2018-1000156: patch: Malicious patch files cause ed to execute arbitrary commands (bsc#1088420).
  • CVE-2014-9637: Prevent DoS by remote attackers (memory consumption and segmentation fault) via a crafted diff file (bsc#914891).
  • CVE-2016-10713: Prevent out-of-bounds access within pch_write_line() that could have lead to DoS via a crafted input file (bsc#1080918).
  • CVE-2010-4651: Fixed a directory traversal bug (bsc#662957):
Record
SUSE-SU-2018:1162-1
Updated
2026-11-02
OSVUSN-3624-1 No score

patch vulnerabilities

It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2016-10713)

It was discovered that Patch incorrectly handled certain input validation. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000156)

It was discovered that Patch incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. (CVE-2018-6951)

Record
USN-3624-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
patch
Alpine:v3.4
 before 2.7.5-r3
2.7.5-r3
patch
Alpine:v3.5
 before 2.7.5-r3
2.7.5-r3
patch
Alpine:v3.6
 before 2.7.5-r3
2.7.5-r3
patch
Debian:12
 before 2.7.6-1
2.7.6-1
patch
Debian:13
 before 2.7.6-1
2.7.6-1
patch
Debian:14
 before 2.7.6-1
2.7.6-1
patch
Mageia:5
 before 2.7.6-1.mga5
2.7.6-1.mga5
patch
Mageia:6
 before 2.7.6-1.mga6
2.7.6-1.mga6
patch
Red Hat:enterprise_linux:7::client
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
Show 17 moreShow less
Affected packages
PackageAffectedFixed
patch
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch
Red Hat:enterprise_linux:7::server
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.1-11.el7
0:2.7.1-11.el7
patch
SUSE:Linux Enterprise Desktop 12 SP3
 before 2.7.5-8.5.1
2.7.5-8.5.1
patch
SUSE:Linux Enterprise Server 12 SP3
 before 2.7.5-8.5.1
2.7.5-8.5.1
patch
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.7.5-8.5.1
2.7.5-8.5.1
patch
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 2.5.9-252.22.7.1
2.5.9-252.22.7.1
patch
SUSE:Linux Enterprise Server 11 SP3-LTSS
 before 2.5.9-252.22.7.1
2.5.9-252.22.7.1
patch
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 2.5.9-252.22.7.1
2.5.9-252.22.7.1
patch
SUSE:Linux Enterprise Server 11 SP4
 before 2.5.9-252.22.7.1
2.5.9-252.22.7.1
patch
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.5.9-252.22.7.1
2.5.9-252.22.7.1
patch
Ubuntu:14.04:LTS
 before 2.7.1-4ubuntu2.4, plus listed versions
2.7.1-32.7.1-42.7.1-4ubuntu12.7.1-4ubuntu22.7.1-4ubuntu2.3
2.7.1-4ubuntu2.4
patch
Ubuntu:16.04:LTS
 before 2.7.5-1ubuntu0.16.04.1, plus listed versions
2.7.5-1
2.7.5-1ubuntu0.16.04.1
patch
openSUSE:Tumbleweed
 before 2.7.6-3.43
2.7.6-3.43

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-10713 is a medium vulnerability (CVSS 5.5) in Gnu Patch, published February 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in patch 2.7.5-r3.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open