Bugzilla – Bug 913678
VUL-0: CVE-2015-1196: patch: directory traversal via symlinks
Last modified: 2016-10-05 06:36:26 UTC
rh#1182154 It was reported [1] that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This could allow an attacker to overwrite arbitrary files by applying a specially crafted patch, with the privileges of the user running patch. A reproducer for this issue is available in [1]. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227 References: https://bugzilla.redhat.com/show_bug.cgi?id=1182154 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1196 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1196.html
bugbot adjusting priority
For openSUSE< submit request to devel:tools / patch: https://build.opensuse.org/request/show/282506 Maintenance request for openSUSE 13.1 and 13.2: https://build.opensuse.org/request/show/282508
openSUSE-SU-2015:0199-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 904519,913678 CVE References: CVE-2015-1196 Sources used: openSUSE 13.2 (src): patch-2.7.3-7.4.1 openSUSE 13.1 (src): patch-2.7.3-4.4.1
This was introduced in 2.7 so SLE 12 is also affected. Can you please provide submits?
Also the fixes are incomplete, see bnc#915329
GNU patch version 2.7.3 breaks legitimate use cases of relative symbolic links. Upstream has reverted the security hot fix: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=290ffcb488bea5caec6d76a34ea8368d00c68875 And instead implemented a secure way of handling symbolic links: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=025a54b789bd88ed15430f8633514e296826983e http://git.savannah.gnu.org/cgit/patch.git/commit/?id=71a3172c7ecb1fad7965843ba373e99a034ee1ce This new approach no longer breaks legitimate use cases. This is all in GNU patch version 2.7.4, so I think we want to trigger another maintenance update.
I have created bug #918058 to track the regression in openSUSE 13.1, 13.2 and Factory.
(In reply to Jean Delvare from comment #6) Can you please submit for SLE 12? Thanks
Submitted: https://build.suse.de/request/show/58910
SUSE-SU-2015:1019-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 904519,913678,915328,915329 CVE References: CVE-2015-1196,CVE-2015-1395,CVE-2015-1396 Sources used: SUSE Linux Enterprise Server 12 (src): patch-2.7.5-7.1 SUSE Linux Enterprise Desktop 12 (src): patch-2.7.5-7.1
Fixed long ago, closing.