PublicDateAtUSN: 2015-01-28
Candidate: CVE-2015-1395
PublicDate: 2017-08-25 18:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1395
 https://ubuntu.com/security/notices/USN-2651-1
Description:
 Directory traversal vulnerability in GNU patch versions which support
 Git-style patching before 2.7.3 allows remote attackers to write to
 arbitrary files with the permissions of the target user via a .. (dot dot)
 in a diff file name.
Ubuntu-Description:
Notes:
 tyhicks> git-style patch support added in 2.7
Bugs:
 https://savannah.gnu.org/bugs/?44059
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775873
Priority: medium
Discovered-by: Jakub Wilk
Assigned-to: tyhicks
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]

Patches_patch:
 upstream: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=17953b5893f7c9835f0dd2a704ba04e0371d2cbd
upstream_patch: released (2.7.3-1)
lucid_patch: not-affected (2.6-2ubuntu1)
precise_patch: not-affected (2.6.1-3)
trusty_patch: released (2.7.1-4ubuntu2.3)
trusty/esm_patch: released (2.7.1-4ubuntu2.3)
utopic_patch: released (2.7.1-5ubuntu0.3)
vivid_patch: released (2.7.3-1)
devel_patch: released (2.7.3-1)