CVE catalog

CVE-2018-1000156

patch: CVE-2018-1000156

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.33% · Oct 25, 2026

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpatchsid2.8.1-1fixed
Debianpatchforky2.8.1-1fixed
Debianpatchtrixie2.8-2fixed
Debianpatchbookworm2.7.6-7fixed
Alpinepatch3.102.7.6-r6fixed
Alpinepatch3.112.7.6-r6fixed
Alpinepatch3.122.7.6-r6fixed
Alpinepatch3.132.7.6-r6fixed
Alpinepatch3.142.7.6-r6fixed
Alpinepatch3.152.7.6-r6fixed
Alpinepatch3.162.7.6-r6fixed
Alpinepatch3.172.7.6-r6fixed
Alpinepatch3.182.7.6-r6fixed
Alpinepatch3.192.7.6-r6fixed
Alpinepatch3.202.7.6-r6fixed
Alpinepatch3.212.7.6-r6fixed
Alpinepatch3.222.7.6-r6fixed
Alpinepatch3.232.7.6-r6fixed
Alpinepatch3.242.7.6-r6fixed
Alpinepatch3.72.7.6-r0fixed
Alpinepatch3.82.7.6-r4fixed
Alpinepatch3.92.7.6-r6fixed
Ubuntupatch14.042.7.1-3vulnerable
Ubuntupatch14.042.7.1-4vulnerable
Ubuntupatch14.042.7.1-4ubuntu1vulnerable
Ubuntupatch14.042.7.1-4ubuntu2vulnerable
Ubuntupatch14.042.7.1-4ubuntu2.3vulnerable
Ubuntupatch14.042.7.1-4ubuntu2.4fixed
Ubuntupatch16.042.7.5-1vulnerable
Ubuntupatch16.042.7.5-1ubuntu0.16.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpatchsourcesid2.7.6-2not yet assignedNot reported[894993]
Debianpatchsourceforky2.7.6-2not yet assignedNot reported[894993]
Debianpatchsourcetrixie2.7.6-2not yet assignedNot reported[894993]
Debianpatchsourcebookworm2.7.6-2not yet assignedNot reported[894993]
Alpinepatchapk3.102.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.112.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.122.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.132.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.142.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.152.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.162.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.172.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.182.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.192.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.202.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.212.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.222.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.232.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.242.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.72.7.6-r0Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.82.7.6-r4Not reportedALPINE-CVE-2018-1000156Not reported
Alpinepatchapk3.92.7.6-r6Not reportedALPINE-CVE-2018-1000156Not reported
Ubuntupatchdeb14.042.7.1-4ubuntu2.4Not reportedUBUNTU-CVE-2018-1000156Not reported
Ubuntupatchdeb16.042.7.5-1ubuntu0.16.04.1Not reportedUBUNTU-CVE-2018-1000156Not reported

[Debian bug #894993]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [patch]Fixed
    Details (2)

    • 2.7.6-7 · amd64 · bookworm

      Fixed · Fixed: 2.7.6-2

      dsa · patch · debian · bookworm; dsa · patch · debian · 12

    • 2.7.6-7 · arm64 · bookworm

      Fixed · Fixed: 2.7.6-2

      dsa · patch · debian · bookworm; dsa · patch · debian · 12

[Debian 13 (Trixie)]

  • [patch]Fixed
    Details (2)

    • 2.8-2 · amd64 · trixie

      Fixed · Fixed: 2.7.6-2

      dsa · patch · debian · 13

    • 2.8-2 · arm64 · trixie

      Fixed · Fixed: 2.7.6-2

      dsa · patch · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]