VDB
JLSEC-2026-16
JLSEC-2026-16
PUBLISHED
CVSS 5.800000190734863 MEDIUM
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Risk Scores
CVSS 2.0
5.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Julia | patch_jll | 0 |
| Julia | patch_jll | 0 |
Timeline
- Mar 31, 2026 CVE Published
- Jul 18, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
References
- http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html url
- https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a url
- https://github.com/irsl/gnu-patch-vulnerabilities url
- https://lists.debian.org/debian-lts-announce/2019/07/msg00016.html url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/ url
- https://seclists.org/bugtraq/2019/Aug/29 url
- https://seclists.org/bugtraq/2019/Jul/54 url
- https://security.gentoo.org/glsa/201908-22 url
- https://security.netapp.com/advisory/ntap-20190828-0001/ url
- https://usn.ubuntu.com/4071-1/ url
- https://usn.ubuntu.com/4071-2/ url
- https://www.debian.org/security/2019/dsa-4489 url