Bug 1545053 (CVE-2018-6952) - CVE-2018-6952 patch: Double free of memory in pch.c:another_hunk() causes a crash
Summary: CVE-2018-6952 patch: Double free of memory in pch.c:another_hunk() causes a c...
Alias: CVE-2018-6952
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1545054 1554752 1554758 1554759
Blocks: 1545055
TreeView+ depends on / blocked
Reported: 2018-02-14 07:19 UTC by Sam Fowler
Modified: 2020-12-17 10:24 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A double-free flaw was found in the way the patch utility processed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches.
Clone Of:
Last Closed: 2019-08-06 13:18:36 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2033 0 None None None 2019-08-06 12:04:55 UTC

Description Sam Fowler 2018-02-14 07:19:30 UTC
GNU patch through version 2.7.6 is vulnerable to a double freeing of memory when supplied a crafted patch file leading to a crash.

Upstream Issue:


Comment 1 Sam Fowler 2018-02-14 07:19:51 UTC
Created patch tracking bugs for this issue:

Affects: fedora-all [bug 1545054]

Comment 7 errata-xmlrpc 2019-08-06 12:04:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2033 https://access.redhat.com/errata/RHSA-2019:2033

Comment 8 Product Security DevOps Team 2019-08-06 13:18:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.