{"id":"CVE-2018-6952","aliases":["ALPINE-CVE-2018-6952","AZL-35104","AZL-6788","BELL-CVE-2018-6952","DEBIAN-CVE-2018-6952","EUVD-2018-18696","GHSA-ffqc-f68h-qq8w","JLSEC-2026-15","MGASA-2018-0448","RHSA-2019:2033","ROOT-OS-DEBIAN-12-CVE-2018-6952","ROOT-OS-UBUNTU-2204-CVE-2018-6952","SUSE-SU-2022:1925-1","SUSE-SU-2022:1932-1","UBUNTU-CVE-2018-6952","openSUSE-SU-2024:12060-1"],"status":"published","title":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0819,"percentile":0.94906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2018-02-13T19:00:00Z","modified":"2026-11-06T20:00:33Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"patch","fixed_in":["2.7.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"patch","fixed_in":["2.7.6-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"patch","fixed_in":["2.7.6-7"],"sources":["osv"]},{"ecosystem":"Julia","package":"patch_jll","fixed_in":["2.8.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"patch","fixed_in":["2.7.6-7.aikido.7","2.7.6-7.root.io.5","2.7.6-7.root.io.2","2.7.6-7.root.io.4","2.7.6-7.root.io.1","2.7.6-7.root.io.6","2.7.6-7.root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-patch","fixed_in":["2.7.6-7.aikido.7","2.7.6-7.root.io.5","2.7.6-7.root.io.2","2.7.6-7.root.io.4","2.7.6-7.root.io.1","2.7.6-7.root.io.6","2.7.6-7.root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-patch","fixed_in":["2.7.6-7build2.aikido.3","2.7.6-7build2.root.io.1","2.7.6-7build2.root.io.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7","2.8-1","2.8-2"]},{"source":"osv","ecosystem":"Debian:13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2"]},{"source":"osv","ecosystem":"Debian:14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2"]},{"source":"osv","ecosystem":"Julia","package":"patch_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7.aikido.7"},{"fixed":"2.7.6-7.root.io.5"},{"fixed":"2.7.6-7.root.io.2"},{"fixed":"2.7.6-7.root.io.4"},{"fixed":"2.7.6-7.root.io.1"},{"fixed":"2.7.6-7.root.io.6"},{"fixed":"2.7.6-7.root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7.aikido.7"},{"fixed":"2.7.6-7.root.io.5"},{"fixed":"2.7.6-7.root.io.2"},{"fixed":"2.7.6-7.root.io.4"},{"fixed":"2.7.6-7.root.io.1"},{"fixed":"2.7.6-7.root.io.6"},{"fixed":"2.7.6-7.root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7build2.aikido.3"},{"fixed":"2.7.6-7build2.root.io.1"},{"fixed":"2.7.6-7build2.root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-8.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-8.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-3","2.7.1-4","2.7.1-4ubuntu1","2.7.1-4ubuntu2","2.7.1-4ubuntu2.3","2.7.1-4ubuntu2.4","2.7.1-4ubuntu2.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1","2.7.5-1ubuntu0.16.04.1","2.7.5-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1build1","2.7.6-1","2.7.6-2ubuntu1","2.7.6-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7","2.7.6-7build1","2.7.6-7build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build2","2.7.6-7build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build3","2.8-1","2.8-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-5.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"patch"}],"references":[{"url":"https://savannah.gnu.org/bugs/index.php?53133","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/103047","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201904-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2033","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6952","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ffqc-f68h-qq8w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-6952","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-6952","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6952","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0448.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23704","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DTAZPKCAJTAOK6CYQP7SPWNXDIAG4A37/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1626473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1653294","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2033.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10713","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10713","tags":["advisory"]},{"url":"https://savannah.gnu.org/bugs/index.php?45990","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6952","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221925-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080985","tags":["report"]},{"url":"https://bugzilla.suse.com/1111572","tags":["report"]},{"url":"https://bugzilla.suse.com/1142041","tags":["report"]},{"url":"https://bugzilla.suse.com/1198106","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221932-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6952","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:00:00Z","modified":"2024-08-05T06:17:17.357Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18696","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:00:00Z","modified":"2024-08-05T06:17:17Z","updated_at":"2026-11-03T02:40:07.110514Z"}],"ghsa":[{"id":"GHSA-ffqc-f68h-qq8w","title":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2022-05-14T01:09:25Z","modified":"2023-02-02T05:03:20Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:51:37.12522Z"}],"nvd":[{"id":"CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00.573Z","modified":"2026-06-17T02:02:30.21Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"ALPINE-CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00.573Z","modified":"2026-10-23T17:17:55.287940368Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-35104","title":"CVE-2018-6952 affecting package patch for versions less than 2.7.6-9","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6788","title":"CVE-2018-6952 affecting package patch for versions less than 2.7.6-7","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00Z","modified":"2026-04-21T04:38:17.243484Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2018-6952","title":"CVE-2018-6952 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:29.538321Z","modified":"2026-01-26T09:48:45.495661Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00.573Z","modified":"2026-04-16T06:16:17.332963029Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00.573Z","modified":"2026-10-23T18:03:23.376062964Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"JLSEC-2026-15","description":"A double free exists in the `another_hunk` function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2026-03-31T16:50:26.988Z","modified":"2026-07-25T18:23:56.463180445Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2019:2033","title":"Red Hat Security Advisory: patch security and bug fix update","status":"published","published":"2024-09-16T01:52:38Z","modified":"2026-06-26T10:42:43Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2018-6952","description":"A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.","status":"published","published":"2018-02-13T19:29:00Z","modified":"2026-11-06T20:00:33.961529522Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T20:07:08.647364Z"},{"id":"MGASA-2018-0448","title":"Updated patch packages fix security vulnerabilities","description":"A NULL pointer dereference flaw was found in the way patch processed\npatch files. An attacker could potentially use this flaw to crash patch\nby tricking it into processing crafted patches (CVE-2018-6951).\n\nA double-free flaw was found in the way the patch utility processed\npatch files. An attacker could potentially use this flaw to crash the\npatch utility by tricking it into processing crafted patches\n(CVE-2018-6952).\n","status":"published","published":"2018-11-15T22:04:32Z","modified":"2026-04-16T06:25:09.306420551Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:12060-1","title":"patch-2.7.6-5.1 on GA media","description":"These are all security issues fixed in the patch-2.7.6-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:05.47873Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2018-6952","title":"CVE-2018-6952 in patch - Patched by Root","description":"Root has patched CVE-2018-6952 in the patch package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T14:03:30Z","modified":"2026-08-26T01:15:02.003858421Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2018-6952","title":"CVE-2018-6952 in rootio-patch - Patched by Root","description":"Root has patched CVE-2018-6952 in the rootio-patch package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-07-27T19:42:27Z","modified":"2026-07-28T12:34:58Z","updated_at":"2026-11-02T15:53:33.943322Z"},{"id":"SUSE-SU-2022:1925-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-13636: Fixed follow symlinks unless --follow-symlinks is given. This increases the security against malicious patches (bsc#1142041).\n- CVE-2018-6952: Fixed swapping fakelines in pch_swap. This bug was causing a double free leading to a crash (bsc#1080985).\n\nBugfixes:\n\n- Abort when cleaning up fails. This bug could cause an infinite loop when a patch wouldn't apply, leading to a segmentation fault (bsc#1111572).\n- Pass the correct stat to backup files. This bug would occasionally cause backup files to be missing when all hunks failed to apply (bsc#1198106).\n","status":"published","published":"2022-06-02T12:35:31Z","modified":"2026-02-04T02:55:56.757693Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1932-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2019-13636: Fixed mishandled following of symlinks in certain cases other than input files (bsc#1142041).\n- CVE-2018-6952: Fixed double free of memory in pch.c:another_hunk() (bsc#1080985).\n\nBugfixes:\n\n- Pass the correct stat to backup files (bsc#1198106).\n- Fix temporary file leak when applying ed-style patches (bsc#1092500).\n","status":"published","published":"2022-06-03T08:26:34Z","modified":"2026-02-04T04:39:13.139391Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}