CVE catalog

CVE-2019-13636

patch: CVE-2019-13636

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
3.90% · Oct 25, 2026

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpatchsid2.8.1-1fixed
Debianpatchforky2.8.1-1fixed
Debianpatchtrixie2.8-2fixed
Debianpatchbookworm2.7.6-7fixed
Alpinepatch3.102.7.6-r5fixed
Alpinepatch3.112.7.6-r5fixed
Alpinepatch3.122.7.6-r5fixed
Alpinepatch3.132.7.6-r5fixed
Alpinepatch3.142.7.6-r5fixed
Alpinepatch3.152.7.6-r5fixed
Alpinepatch3.162.7.6-r5fixed
Alpinepatch3.172.7.6-r5fixed
Alpinepatch3.182.7.6-r5fixed
Alpinepatch3.192.7.6-r5fixed
Alpinepatch3.202.7.6-r5fixed
Alpinepatch3.212.7.6-r5fixed
Alpinepatch3.222.7.6-r5fixed
Alpinepatch3.232.7.6-r5fixed
Alpinepatch3.242.7.6-r5fixed
Alpinepatch3.72.7.5-r3fixed
Alpinepatch3.82.7.6-r3fixed
Alpinepatch3.92.7.6-r5fixed
Ubuntupatch16.042.7.5-1vulnerable
Ubuntupatch16.042.7.5-1ubuntu0.16.04.1vulnerable
Ubuntupatch16.042.7.5-1ubuntu0.16.04.2fixed
Ubuntupatch18.042.7.5-1build1vulnerable
Ubuntupatch18.042.7.6-1vulnerable
Ubuntupatch18.042.7.6-2ubuntu1vulnerable
Ubuntupatch18.042.7.6-2ubuntu1.1fixed
Ubuntupatchpro2.7.1-3vulnerable
Ubuntupatchpro2.7.1-4vulnerable
Ubuntupatchpro2.7.1-4ubuntu1vulnerable
Ubuntupatchpro2.7.1-4ubuntu2vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.3vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.4vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.4+esm1fixed
Ubuntupatchpro2.7.1-3vulnerable
Ubuntupatchpro2.7.1-4vulnerable
Ubuntupatchpro2.7.1-4ubuntu1vulnerable
Ubuntupatchpro2.7.1-4ubuntu2vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.3vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.4vulnerable
Ubuntupatchpro2.7.1-4ubuntu2.4+esm1fixed
Ubuntupatch16.042.7.5-1vulnerable
Ubuntupatch16.042.7.5-1ubuntu0.16.04.1vulnerable
Ubuntupatch16.042.7.5-1ubuntu0.16.04.2fixed
Ubuntupatch18.042.7.5-1build1vulnerable
Ubuntupatch18.042.7.6-1vulnerable
Ubuntupatch18.042.7.6-2ubuntu1vulnerable
Ubuntupatch18.042.7.6-2ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpatchsourcesid2.7.6-5not yet assignedNot reported[932401]
Debianpatchsourceforky2.7.6-5not yet assignedNot reported[932401]
Debianpatchsourcetrixie2.7.6-5not yet assignedNot reported[932401]
Debianpatchsourcebookworm2.7.6-5not yet assignedNot reported[932401]
Alpinepatchapk3.102.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.112.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.122.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.132.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.142.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.152.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.162.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.172.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.182.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.192.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.202.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.212.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.222.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.232.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.242.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.72.7.5-r3Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.82.7.6-r3Not reportedALPINE-CVE-2019-13636Not reported
Alpinepatchapk3.92.7.6-r5Not reportedALPINE-CVE-2019-13636Not reported
Ubuntupatchdeb16.042.7.5-1ubuntu0.16.04.2Not reportedUSN-4071-1Not reported
Ubuntupatchdeb18.042.7.6-2ubuntu1.1Not reportedUSN-4071-1Not reported
Ubuntupatchdebpro2.7.1-4ubuntu2.4+esm1Not reportedUSN-4071-2Not reported
Ubuntupatchdebpro2.7.1-4ubuntu2.4+esm1Not reportedUBUNTU-CVE-2019-13636Not reported
Ubuntupatchdeb16.042.7.5-1ubuntu0.16.04.2Not reportedUBUNTU-CVE-2019-13636Not reported
Ubuntupatchdeb18.042.7.6-2ubuntu1.1Not reportedUBUNTU-CVE-2019-13636Not reported

[Debian bug #932401]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [patch]Fixed
    Details (2)

    • 2.7.6-7 · amd64 · bookworm

      Fixed · Fixed: 2.7.6-5

      dsa · patch · debian · bookworm; dsa · patch · debian · 12

    • 2.7.6-7 · arm64 · bookworm

      Fixed · Fixed: 2.7.6-5

      dsa · patch · debian · bookworm; dsa · patch · debian · 12

[Debian 13 (Trixie)]

  • [patch]Fixed
    Details (2)

    • 2.8-2 · amd64 · trixie

      Fixed · Fixed: 2.7.6-5

      dsa · patch · debian · 13

    • 2.8-2 · arm64 · trixie

      Fixed · Fixed: 2.7.6-5

      dsa · patch · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]