CVE-2015-1196

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.savannah.gnu.org/cgit/patch.git/commit/?id=4e9269a5fc1fe80a1095a92593dd85db871e1fd3Patch
http://lists.opensuse.org/opensuse-updates/2015-02/msg00013.htmlThird Party Advisory
http://seclists.org/oss-sec/2015/q1/173Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
http://www.securityfocus.com/bid/72074Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=1182154Issue Tracking, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99967
http://git.savannah.gnu.org/cgit/patch.git/commit/?id=4e9269a5fc1fe80a1095a92593dd85db871e1fd3Patch
http://lists.opensuse.org/opensuse-updates/2015-02/msg00013.htmlThird Party Advisory
http://seclists.org/oss-sec/2015/q1/173Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
http://www.securityfocus.com/bid/72074Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=1182154Issue Tracking, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99967

Timeline

Published: Jan 21, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-11971.9cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in a CVE-2015-11987.5Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.CVE-2015-11997.5Directory traversal vulnerability in ppmd 10.1-5.CVE-2015-12002.1Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission CVE-2015-12015.0Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the CVE-2015-12044.3Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remot CVE-2015-12057.5Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have othe CVE-2015-12065.5Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and proces CVE-2015-12076.5Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (CVE-2015-12085.5Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive i CVE-2015-12097.5Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM CVE-2015-12105.0The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Ch