CVE-2010-4651

Published: Mar 11, 2011Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

Affected (5)

Products: Gnu: Gnu Patch

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnu Patch	Up to 2.6.1
Gnu Gnu Patch	Version 2.5.4
Gnu Gnu Patch	Version 2.5.9
Gnu Gnu Patch	Version 2.5
Gnu Gnu Patch	Version 2.6

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (30)

http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1

Source: secalert@redhat.com

Patch

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055241.html

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055246.html

Source: secalert@redhat.com

Patch

http://lists.gnu.org/archive/html/bug-patch/2010-12/msg00000.html

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/01/05/10

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/01/06/19

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/01/06/20

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/01/06/21

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/43663

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43677

Source: secalert@redhat.com

Vendor Advisory

http://support.apple.com/kb/HT4723

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46768

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0600

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=667529

Source: secalert@redhat.com

Patch

http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055241.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055246.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.gnu.org/archive/html/bug-patch/2010-12/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://openwall.com/lists/oss-security/2011/01/05/10

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://openwall.com/lists/oss-security/2011/01/06/19

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://openwall.com/lists/oss-security/2011/01/06/20

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/01/06/21

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/43663

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43677

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://support.apple.com/kb/HT4723

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/46768

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0600

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=667529

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.