CVE-2018-1000156 json
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation…
published 8y ago modified 3mo ago also EUVD-2018-1862 , JLSEC-2026-12
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.3%
- EPSS 5.3% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
Patch / fix
- julia patch_jll 2.8.0+0
- patch Debian 14, Debian 13, Debian 12 2.7.6-2
debian advisories DEBIAN-CVE-2018-1000156
- patch Ubuntu 14.04 LTS 2.7.1-4ubuntu2.4
- patch Ubuntu 16.04 LTS 2.7.5-1ubuntu0.16.04.1
ubuntu advisories UBUNTU-CVE-2018-1000156
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- patch RHEL 6 2.6-8.el6_9
- patch RHEL 7 2.7.1-10.el7_5
- patch RHEL 7.4 EUS 2.7.1-10.el7_4
- patch RHEL 7.3 EUS 2.7.1-10.el7_3
- patch RHEL 7.2 TUS, RHEL 7.2 E4S, RHEL 7.2 AUS 2.7.1-10.el7_2
- patch RHEL 6.7 EUS 2.6-8.el6_7
- patch RHEL 6.6 TUS, RHEL 6.6 AUS 2.6-8.el6_6
- patch RHEL 6.5 AUS 2.6-8.el6_5
red hat advisories RHSA-2018:2091RHSA-2018:2092RHSA-2018:2093RHSA-2018:2094RHSA-2018:2095RHSA-2018:2096
- patch SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 2.5.9-252.22.7.1
- patch SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 2.7.5-8.5.1
suse advisories SUSE-SU-2018:1162-1SUSE-SU-2018:1128-1
- patch openSUSE Tumbleweed 2.7.6-3.43
opensuse advisories openSUSE-SU-2024:11151-1
- patch Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 2.7.6-r6
- patch Alpine 3.7 2.7.6-r0
- patch Alpine 3.8 2.7.6-r4
alpine advisories ALPINE-CVE-2018-1000156
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- patch Azure Linux 3.0 2.7.6-9
- patch CBL-Mariner 2.0 2.7.6-7
azure linux advisories AZL-35101AZL-6785
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Is CVE-2018-1000156 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1000156 updated cvss 7.8
patch: Malicious patch files cause ed to execute arbitrary commands
-
Red Hat Enterprise Linux 5 patchaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) patch 2.7.1-10.el7_5 Red Hat Enterprise Linux ComputeNode (v. 7) patch 2.7.1-10.el7_5fixed: vendor fix RHSA-2018:1200
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.3) patch 2.7.1-10.el7_3fixed: vendor fix RHSA-2018:2092
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) patch 2.7.1-10.el7_4fixed: vendor fix RHSA-2018:2091
-
Red Hat Enterprise Linux Desktop (v. 6) patch 2.6-8.el6_9fixed: vendor fix RHSA-2018:1199
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) patch 2.7.1-10.el7_5fixed: vendor fix RHSA-2018:1200
-
Red Hat Enterprise Linux HPC Node (v. 6) patch 2.6-8.el6_9fixed: vendor fix RHSA-2018:1199
-
Red Hat Enterprise Linux HPC Node EUS (v. 6.7) patch 2.6-8.el6_7fixed: vendor fix RHSA-2018:2094
show 14 moreshow fewer
-
Red Hat Enterprise Linux Server (v. 6) patch 2.6-8.el6_9fixed: vendor fix RHSA-2018:1199
-
Red Hat Enterprise Linux Server (v. 7) patch 2.7.1-10.el7_5fixed: vendor fix RHSA-2018:1200
-
Red Hat Enterprise Linux Server AUS (v. 6.4) patch 2.6-8.el6_4fixed: vendor fix RHSA-2018:2097
-
Red Hat Enterprise Linux Server AUS (v. 6.5) patch 2.6-8.el6_5fixed: vendor fix RHSA-2018:2096
-
Red Hat Enterprise Linux Server AUS (v. 6.6) patch 2.6-8.el6_6fixed: vendor fix RHSA-2018:2095
-
Red Hat Enterprise Linux Server AUS (v. 7.2) patch 2.7.1-10.el7_2 Red Hat Enterprise Linux Server E4S (v. 7.2) patch 2.7.1-10.el7_2fixed: vendor fix RHSA-2018:2093
-
Red Hat Enterprise Linux Server EUS (v. 6.7) patch 2.6-8.el6_7fixed: vendor fix RHSA-2018:2094
-
Red Hat Enterprise Linux Server EUS (v. 7.3) patch 2.7.1-10.el7_3fixed: vendor fix RHSA-2018:2092
-
Red Hat Enterprise Linux Server EUS (v. 7.4) patch 2.7.1-10.el7_4fixed: vendor fix RHSA-2018:2091
-
Red Hat Enterprise Linux Server TUS (v. 6.6) patch 2.6-8.el6_6fixed: vendor fix RHSA-2018:2095
-
Red Hat Enterprise Linux Server TUS (v. 7.2) patch 2.7.1-10.el7_2fixed: vendor fix RHSA-2018:2093
-
Red Hat Enterprise Linux Workstation (v. 6) patch 2.6-8.el6_9fixed: vendor fix RHSA-2018:1199
-
Red Hat Enterprise Linux Workstation (v. 7) patch 2.7.1-10.el7_5fixed: vendor fix RHSA-2018:1200
-
Red Hat Enterprise Linux 8 patchnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
5.33% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| OSV | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | patch_jll | <2.8.0+0 |
2.8.0+0 |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
usn.ubuntu.com
/3624-2/
vendor-advisory, third-party-advisory, web
-
usn.ubuntu.com
/3624-1/
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2091
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2094
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2093
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:1200
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2095
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:1199
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2092
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2097
vendor-advisory, third-party-advisory, web
-
access.redhat.com
/errata/RHSA-2018:2096
vendor-advisory, third-party-advisory, web
-
security.gentoo.org
/glsa/201904-17
vendor-advisory, third-party-advisory, web
-
savannah.gnu.org
/bugs/index.php?53566
vendor-advisory, web
-
lists.debian.org
/debian-lts-announce/2018/04/msg00013.html
mailing-list, third-party-advisory, web
-
rachelbythebay.com
/w/2018/04/05/bangpatch/
third-party-advisory, web
-
bugs.debian.org
/cgi-bin/bugreport.cgi?bug=894667#19
issue-tracking, third-party-advisory, web
-
seclists.org
/bugtraq/2019/Jul/54
mailing-list, web
-
seclists.org
/bugtraq/2019/Aug/29
mailing-list, web
-
packetstormsecurity.com
/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
web
-
web.archive.org
/web/20180405231329/https://twitter.com/kurtseifried/status/982028968877436928
web
-
twitter.com
/kurtseifried/status/982028968877436928
third-party-advisory, web
Sources
- CVE List CVE-2018-1000156
- NVD CVE-2018-1000156
- OSV JLSEC-2026-12
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.