{"id":"CVE-2019-20633","aliases":["ALPINE-CVE-2019-20633","AZL-35107","AZL-6791","BELL-CVE-2019-20633","EUVD-2019-11172","GHSA-w88p-xvmw-fxgg","JLSEC-2026-18","SUSE-SU-2024:2704-1","SUSE-SU-2024:2780-1","SUSE-SU-2025:20075-1","UBUNTU-CVE-2019-20633","openSUSE-SU-2024:14239-1"],"status":"published","title":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function...","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01019,"percentile":0.636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2020-03-25T16:44:49Z","modified":"2026-11-06T20:00:33Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"patch","fixed_in":["2.7.6-r7"],"sources":["osv"]},{"ecosystem":"Julia","package":"patch_jll","fixed_in":["2.8.0+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"patch","fixed_in":["2.7.5-8.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"patch","fixed_in":["2.7.5-8.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"patch","fixed_in":["2.7.6-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"patch","fixed_in":["2.7.6-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"patch","fixed_in":["2.7.6-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"patch","fixed_in":["2.7.6-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"patch","fixed_in":["2.7.6-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"patch","fixed_in":["2.7.6-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.6-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.6-8"}]}]},{"source":"osv","ecosystem":"Julia","package":"patch_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.0+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-8.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-8.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-3","2.7.1-4","2.7.1-4ubuntu1","2.7.1-4ubuntu2","2.7.1-4ubuntu2.3","2.7.1-4ubuntu2.4","2.7.1-4ubuntu2.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1","2.7.5-1ubuntu0.16.04.1","2.7.5-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1build1","2.7.6-1","2.7.6-2ubuntu1","2.7.6-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7","2.7.6-7build1","2.7.6-7build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build2","2.7.6-7build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build3","2.8-1","2.8-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8.1"}]}]}],"products":[{"vendor":"gnu","product":"patch"}],"references":[{"url":"https://savannah.gnu.org/bugs/index.php?56683","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20633","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w88p-xvmw-fxgg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-20633","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-20633","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242704-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167721","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20633","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242780-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520075-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20633","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-20633","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T16:44:49Z","modified":"2024-08-05T02:46:10.304Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-11172","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T16:44:49Z","modified":"2024-08-05T02:46:10Z","updated_at":"2026-11-03T02:40:21.253488Z"}],"ghsa":[{"id":"GHSA-w88p-xvmw-fxgg","title":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function...","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2022-05-24T17:12:37Z","modified":"2023-01-29T05:02:02Z","cwes":["CWE-415"],"updated_at":"2026-11-02T14:44:58.707257Z"}],"nvd":[{"id":"CVE-2019-20633","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:14.013Z","modified":"2026-06-17T02:30:50.59Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"ALPINE-CVE-2019-20633","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:14.013Z","modified":"2026-09-21T06:17:52.511887483Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-35107","title":"CVE-2019-20633 affecting package patch 2.7.6-10","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:14Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6791","title":"CVE-2019-20633 affecting package patch 2.7.6-8","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:14Z","modified":"2026-04-21T04:38:17.269512Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2019-20633","title":"CVE-2019-20633 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:34.858931Z","modified":"2026-01-26T09:47:27.662973Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-20633","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:14.013Z","modified":"2026-03-23T05:04:12.682286Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"JLSEC-2026-18","description":"GNU patch through 2.7.6 contains a free(`p_line`[`p_end`]) Double Free vulnerability in the function `another_hunk` in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2026-03-31T16:50:26.988Z","modified":"2026-07-25T18:23:48.154676161Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2019-20633","description":"GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.","status":"published","published":"2020-03-25T17:15:00Z","modified":"2026-11-06T20:00:33.949431413Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T20:07:08.647364Z"},{"id":"openSUSE-SU-2024:14239-1","title":"patch-2.7.6-8.1 on GA media","description":"These are all security issues fixed in the patch-2.7.6-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2026-02-04T04:14:35.718962Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2704-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2019-20633: Fixed double-free/OOB read in pch.c (bsc#1167721)\n","status":"published","published":"2024-08-01T21:34:45Z","modified":"2026-02-04T02:43:16.061359Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2780-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2019-20633: Fixed double-free/OOB read in pch.c (bsc#1167721)\n","status":"published","published":"2024-08-06T12:36:07Z","modified":"2026-02-04T03:00:01.702716Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20075-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2019-20633: Fix double-free/OOB read in pch.c (bsc#1167721)\n","status":"published","published":"2025-02-03T09:04:33Z","modified":"2026-03-23T04:48:51.920306Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}