VYPR
← All advisories
High severity7.8NVD Advisory· Published Jul 26, 2019· Updated Jun 17, 2026

CVE-2019-13638

CVE-2019-13638

Description

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • GNU/Patch2 versions
    cpe:2.3:a:gnu:patch:2.7.6:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:gnu:patch:2.7.6:*:*:*:*:*:*:*
    • (no CPE)range: <=2.7.6
  • Debian/linux3 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • GNU/patchdescription
  • osv-coords4 versions
    pkg:apk/chainguard/patchpkg:apk/chainguard/patch-docpkg:apk/wolfi/patchpkg:apk/wolfi/patch-doc
    < 2.7.6-r3+ 3 more
    • (no CPE)range: < 2.7.6-r3
    • (no CPE)range: < 2.7.6-r3
    • (no CPE)range: < 2.7.6-r3
    • (no CPE)range: < 2.7.6-r3

Patches

Vulnerability mechanics

References

14

News mentions

0

No linked articles in our index yet.