{"id":"CVE-2021-45261","aliases":["CLSA-2026-1788355583","DEBIAN-CVE-2021-45261","EUVD-2021-32041","GHSA-5wqw-cqhv-q8cv","ROOT-OS-DEBIAN-12-CVE-2021-45261","SUSE-SU-2026:0781-1","SUSE-SU-2026:20343-1","SUSE-SU-2026:20431-1","SUSE-SU-2026:22905-1","SUSE-SU-2026:23210-1","SUSE-SU-2026:2922-1","UBUNTU-CVE-2021-45261","openSUSE-SU-2026:10140-1","openSUSE-SU-2026:20227-1"],"status":"published","title":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which...","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00759,"percentile":0.55513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-763"],"published":"2021-12-22T17:12:19Z","modified":"2026-10-26T09:30:33Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"patch","fixed_in":["2.7.6-16.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"patch","fixed_in":["2.7.6-7.aikido.7","2.7.6-7.root.io.5","2.7.6-7.root.io.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-patch","fixed_in":["2.7.6-7.aikido.7","2.7.6-7.root.io.5","2.7.6-7.root.io.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"patch","fixed_in":["2.7.6-150000.5.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"patch","fixed_in":["2.7.6-150000.5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"patch","fixed_in":["2.7.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"patch","fixed_in":["2.7.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"patch","fixed_in":["2.7.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"patch","fixed_in":["2.8-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"patch","fixed_in":["2.7.6-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-16.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7","2.8-1","2.8-2"]},{"source":"osv","ecosystem":"Debian:13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2"]},{"source":"osv","ecosystem":"Debian:14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7.aikido.7"},{"fixed":"2.7.6-7.root.io.5"},{"fixed":"2.7.6-7.root.io.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7.aikido.7"},{"fixed":"2.7.6-7.root.io.5"},{"fixed":"2.7.6-7.root.io.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-150000.5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-slfo.1.1_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-8.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-3","2.7.1-4","2.7.1-4ubuntu1","2.7.1-4ubuntu2","2.7.1-4ubuntu2.3","2.7.1-4ubuntu2.4","2.7.1-4ubuntu2.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1","2.7.5-1ubuntu0.16.04.1","2.7.5-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-1build1","2.7.6-1","2.7.6-2ubuntu1","2.7.6-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7","2.7.6-7build1","2.7.6-7build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build2","2.7.6-7build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.6-7build3","2.8-1","2.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2","2.8-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-160000.3.1"}]}]}],"products":[{"vendor":"gnu","product":"patch"}],"references":[{"url":"https://savannah.gnu.org/bugs/?61685","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45261","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wqw-cqhv-q8cv"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788355583.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-45261","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260781-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620343-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620431-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622905-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271166","tags":["report"]},{"url":"https://bugzilla.suse.com/1271167","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56289","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623210-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262922-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45261","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-45261","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T17:12:19Z","modified":"2024-08-04T04:39:20.422Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32041","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T17:12:19Z","modified":"2024-08-04T04:39:20Z","updated_at":"2026-11-03T03:08:27.448176Z"}],"ghsa":[{"id":"GHSA-5wqw-cqhv-q8cv","title":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which...","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-23T00:01:24Z","modified":"2023-02-03T05:03:13Z","cwes":["CWE-763"],"updated_at":"2026-11-02T14:53:19.085994Z"}],"nvd":[{"id":"CVE-2021-45261","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T18:15:08.1Z","modified":"2026-06-17T04:13:14.107Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-763"],"updated_at":"2026-11-02T14:07:02.566991Z"}],"osv":[{"id":"CVE-2021-45261","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T18:15:08.1Z","modified":"2026-08-26T18:28:10.17425779Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-45261","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T18:15:08.1Z","modified":"2026-10-23T18:04:00.783817204Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-45261","description":"An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.","status":"published","published":"2021-12-22T18:15:00Z","modified":"2026-10-17T12:55:47.890524765Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"CLSA-2026-1788355583","title":"patch: Fix of CVE-2021-45261","description":"- CVE-2021-45261: clear the range of p_line[] pointers in another_hunk()\n  before they are used and freed, instead of advancing p_end past\n  uninitialised entries (SUSE vendor fix; no upstream fix exists)","status":"published","published":"2026-09-02T13:26:34Z","modified":"2026-10-26T09:30:33.222319396Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"openSUSE-SU-2026:10140-1","title":"patch-2.8-2.1 on GA media","description":"These are all security issues fixed in the patch-2.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-03-23T04:54:29.986619Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20227-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2021-45261: invalid pointer via another_hunk function can cause a denial-of-service (bsc#1194037).\n","status":"published","published":"2026-02-13T16:41:43Z","modified":"2026-03-23T04:54:48.319582Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2021-45261","title":"CVE-2021-45261 in patch - Patched by Root","description":"Root has patched CVE-2021-45261 in the patch package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T14:03:30Z","modified":"2026-08-26T01:13:46.037397019Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2026:0781-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2021-45261: Clear range of pointers before they are used/freed (bsc#1194037).\n","status":"published","published":"2026-03-03T13:28:08Z","modified":"2026-03-04T22:16:53.178774Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20343-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2021-45261: invalid pointer via another_hunk function can cause a denial-of-service (bsc#1194037).\n","status":"published","published":"2026-02-13T16:41:48Z","modified":"2026-03-23T04:53:17.063914Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20431-1","title":"Security update for patch","description":"This update for patch fixes the following issues:\n\n- CVE-2021-45261: invalid pointer via another_hunk function can cause a denial-of-service (bsc#1194037).\n","status":"published","published":"2026-02-13T16:41:48Z","modified":"2026-03-23T04:52:54.969911Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:22905-1","title":"Security update for patch","description":"This update for patch fixes the following issues\n\n- CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).\n- CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).\n- CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).\n","status":"published","published":"2026-07-23T11:27:48Z","modified":"2026-07-28T18:24:19.465965006Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23210-1","title":"Security update for patch","description":"This update for patch fixes the following issues\n\n- CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).\n- CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).\n- CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).\n","status":"published","published":"2026-08-18T11:03:59Z","modified":"2026-08-26T18:23:32.510012086Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2922-1","title":"Security update for patch","description":"This update for patch fixes the following issues\n\n- CVE-2021-45261: Invalid Pointer via another_hunk function (bsc#1194037).\n- CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).\n- CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).\n","status":"published","published":"2026-07-13T17:47:13Z","modified":"2026-07-15T10:00:04.826651529Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}