TI-2016-08754 Aliases CVE-2016-10713 GHSA-8m7f-5cc5-rjgp

An issue was discovered in GNU patch before 2.7.6.

LOW 28CWE-119Published 2018-02-13 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

Why it matters now

EPSS 0.01558 75th percentileScored 2026-11-07

Fix Partial Red Hat: 1 advisoryRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:patch::::::::	before 2.7.6	Vulnerable	GNU

cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:* Versions before 2.7.6 Vulnerable ·GNU

Remediation

Red Hat 1 advisory

RHSA-2019:2033 Released 2019-08-06 · Red Hat rating Low
patch security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) patch-2.7.1-11.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) patch-2.7.1-11.el7
- Red Hat Enterprise Linux Server (v. 7) patch-2.7.1-11.el7
- Red Hat Enterprise Linux Workstation (v. 7) patch-2.7.1-11.el7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix yet
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2019:2033
Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2019:2033
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2019:2033
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2019:2033

Not affected: 1 product

Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2016-10713
2026-10-03 Alias added: GHSA-8m7f-5cc5-rjgp

References

Patch 1

https://git.savannah.gnu.org/cgit/patch.git/commit/src/pch.c?id=a0d7fe4589651c64bd16ddaaa634030bb0455866

Advisory 3

TI-2015-01271 Directory traversal vulnerability in GNU patch versions which support Git-style patching… CVSS 3.0HIGH 7.5
TI-2018-05076 A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. CVSS 3.0HIGH 7.5
TI-2018-05075 An issue was discovered in GNU patch through 2.7.6. CVSS 3.0HIGH 7.5
TI-2018-15808 GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch… CVSS 3.0HIGH 7.8
TI-2019-10248 GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited… CVSS 3.0HIGH 7.8
TI-2018-14931 do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a… CVSS 3.0HIGH 7.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences