CVE-2019-20633 is a double-free vulnerability affecting GNU patch through version 2.7.6, specifically within the 'another_hunk' function in 'pch.c'. This flaw, an incomplete fix for CVE-2018-6952, allows a denial of service through a specially crafted patch file. Rated Medium severity (CVSS 5.5), it requires local access and user interaction for exploitation, leading to high availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.7.6CPE matchmatch criteria | cpe:2.3:a:gnu:patch:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.
Mar 10, 2020patch: double free in another_hunk function in pch.c
Jul 28, 2019