Vulnerability CVE-2014-9637

Vulnerability Name:

CVE-2014-9637 (CCN-100333)

Assigned:

2015-01-23

Published:

2015-01-23

Updated:

2017-08-30

Summary:

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file.

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

7.1 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

1.9 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P)
1.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-399

Vulnerability Consequences:

Denial of Service

References:

Source: CONFIRM
Type: Patch, Third Party Advisory
http://advisories.mageia.org/MGASA-2015-0068.html

Source: MITRE
Type: CNA
CVE-2014-9637

Source: CCN
Type: Gnu patch Git Repository
patch.git - GNU patch

Source: FEDORA
Type: Patch, Third Party Advisory
FEDORA-2015-1165

Source: FEDORA
Type: Patch, Third Party Advisory
FEDORA-2015-1134

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20150122 Re: CVE request: directory traversal flaw in patch

Source: BID
Type: Third Party Advisory, VDB Entry
72286

Source: CCN
Type: BID-72286
GNU patch 'set_hunkmax()' Function Denial of Service Vulnerability

Source: UBUNTU
Type: Patch, Third Party Advisory
USN-2651-1

Source: CCN
Type: Red Hat Bugzilla Bug 1185262
(CVE-2014-9637) CVE-2014-9637 patch: local denial of service with a crafted patch

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1185262

Source: XF
Type: UNKNOWN
gnupatch-cve20149637-dos(100333)

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://git.savannah.gnu.org/cgit/patch.git/commit/?id=0c08d7a902c6fdd49b704623a12d8d672ef18944

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://savannah.gnu.org/bugs/?44051

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-9637

Vulnerable Configuration:

Configuration 1:

cpe:/o:fedoraproject:fedora:20:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:21:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:mageia:mageia:4.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:gnu:patch:*:*:*:*:*:*:*:* (Version <= 2.7.2)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20149637	V	CVE-2014-9637	2022-05-20
oval:org.opensuse.security:def:32241	P	Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)	2021-12-14
oval:org.opensuse.security:def:34014	P	Security update for xorg-x11-server (Important)	2021-12-14
oval:org.opensuse.security:def:33063	P	Security update for xorg-x11-server (Important)	2021-12-14
oval:org.opensuse.security:def:34610	P	Security update for MozillaFirefox (Important)	2021-12-12
oval:org.opensuse.security:def:30272	P	Security update for java-1_8_0-openjdk (Important)	2021-11-23
oval:org.opensuse.security:def:30144	P	Security update for binutils (Moderate)	2021-11-09
oval:org.opensuse.security:def:32202	P	Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)	2021-10-18
oval:org.opensuse.security:def:34552	P	Security update for python-urllib3 (Moderate)	2021-09-29
oval:org.opensuse.security:def:29425	P	Security update for MozillaFirefox (Important)	2021-09-22
oval:org.opensuse.security:def:33006	P	Security update for openssl (Low)	2021-09-20
oval:org.opensuse.security:def:30126	P	Security update for gtk-vnc (Moderate)	2021-09-16
oval:org.opensuse.security:def:29408	P	Security update for MozillaFirefox (Important)	2021-08-17
oval:org.opensuse.security:def:30107	P	Security update for webkit2gtk3 (Important)	2021-08-03
oval:org.opensuse.security:def:30215	P	Security update for xterm (Important)	2021-06-18
oval:org.opensuse.security:def:33930	P	Security update for java-1_8_0-openjdk (Moderate)	2021-06-15
oval:org.opensuse.security:def:31199	P	Security update for freeradius-server (Moderate)	2021-06-11
oval:org.opensuse.security:def:36293	P	socat-1.7.0.0-1.16.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36251	P	ntp-4.2.8p2-2.18 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:33919	P	Security update for gstreamer-plugins-bad (Important)	2021-06-07
oval:org.opensuse.security:def:33918	P	Security update for polkit (Important)	2021-06-03
oval:org.opensuse.security:def:29369	P	Security update for djvulibre (Important)	2021-05-31
oval:org.opensuse.security:def:32911	P	Security update for bind (Important)	2021-05-04
oval:org.opensuse.security:def:34659	P	Security update for python36 (Moderate)	2021-03-19
oval:org.opensuse.security:def:31356	P	Security update for python (Moderate)	2021-03-16
oval:org.opensuse.security:def:31355	P	Security update for git (Important)	2021-03-09
oval:org.opensuse.security:def:29469	P	Security update for jasper (Important)	2021-02-16
oval:org.opensuse.security:def:35235	P	Security update for openexr (Moderate)	2020-12-23
oval:org.opensuse.security:def:35569	P	kde4-kgreeter-plugins-4.3.5-0.8.35 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35542	P	evolution-data-server-2.28.2-0.10.9 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35613	P	mono-core-2.0.1-1.19.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:32697	P	kvm on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29114	P	Security update for java-1_7_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:34698	P	Security update for xorg-x11-libXv	2020-12-01
oval:org.opensuse.security:def:32686	P	java-1_6_0-ibm on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29030	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:32685	P	java-1_4_2-ibm on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:28973	P	Security update for rpcbind (Moderate)	2020-12-01
oval:org.opensuse.security:def:28887	P	Security update for compat-openssl097g (Moderate)	2020-12-01
oval:org.opensuse.security:def:30718	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:28756	P	Security update for libpng	2020-12-01
oval:org.opensuse.security:def:34394	P	Security update for unzip (Moderate)	2020-12-01
oval:org.opensuse.security:def:30674	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:28687	P	Security update for flash-player (Moderate)	2020-12-01
oval:org.opensuse.security:def:34305	P	Security update for quagga (Moderate)	2020-12-01
oval:org.opensuse.security:def:30655	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:28676	P	Security update for Mozilla Firefox	2020-12-01
oval:org.opensuse.security:def:34248	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:30616	P	Security update for tomcat6	2020-12-01
oval:org.opensuse.security:def:29212	P	Security update for patch (Important)	2020-12-01
oval:org.opensuse.security:def:28675	P	Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:34150	P	Security update for openssh (Moderate)	2020-12-01
oval:org.opensuse.security:def:30567	P	Security update for libvirt	2020-12-01
oval:org.opensuse.security:def:29176	P	Security update for microcode_ctl (Important)	2020-12-01
oval:org.opensuse.security:def:30512	P	Security update for MozillaFirefox	2020-12-01
oval:org.opensuse.security:def:30358	P	Security update for wget	2020-12-01
oval:org.opensuse.security:def:35503	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:34196	P	Security update for patch (Important)	2020-12-01
oval:org.opensuse.security:def:35454	P	Security update for perl-DBD-mysql (Moderate)	2020-12-01
oval:org.opensuse.security:def:34156	P	Security update for openssh	2020-12-01
oval:org.opensuse.security:def:35395	P	Security update for openslp (Important)	2020-12-01
oval:org.opensuse.security:def:31564	P	Security update for squid3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:29994	P	Security update for libtcnative-1-0 (Important)	2020-12-01
oval:org.opensuse.security:def:31520	P	Security update for rpcbind (Moderate)	2020-12-01
oval:org.opensuse.security:def:29920	P	Security update for libevent (Moderate)	2020-12-01
oval:org.opensuse.security:def:35145	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:31499	P	Security update for python-paramiko (Important)	2020-12-01
oval:org.opensuse.security:def:29909	P	Security update for libHX13	2020-12-01
oval:org.opensuse.security:def:35088	P	Security update for kdebase4-workspace	2020-12-01
oval:org.opensuse.security:def:31460	P	Security update for postgresql94 (Important)	2020-12-01
oval:org.opensuse.security:def:29908	P	Security update for lha (Moderate)	2020-12-01
oval:org.opensuse.security:def:34987	P	Security update for giflib (Moderate)	2020-12-01
oval:org.opensuse.security:def:31411	P	Security update for php53 (Important)	2020-12-01
oval:org.opensuse.security:def:34851	P	Security update for bsdtar (Important)	2020-12-01
oval:org.opensuse.security:def:28538	P	Security update for coreutils	2020-12-01
oval:org.opensuse.security:def:34767	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:28494	P	Security update for openssl1	2020-12-01
oval:org.opensuse.security:def:34756	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:31112	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:28479	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:35446	P	Security update for patch (Important)	2020-12-01
oval:org.opensuse.security:def:34755	P	Security update for MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:31055	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:28440	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:35405	P	Security update for openssh-openssl1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30963	P	Security update for gpgme	2020-12-01
oval:org.opensuse.security:def:28391	P	Security update for samba (Important)	2020-12-01
oval:org.opensuse.security:def:33518	P	Security update for sendmail	2020-12-01
oval:org.opensuse.security:def:30831	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:28338	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:33474	P	Security update for libesmtp	2020-12-01
oval:org.opensuse.security:def:30757	P	Security update for apache2 (Important)	2020-12-01
oval:org.opensuse.security:def:28186	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:33451	P	Security update for GNOME screensaver	2020-12-01
oval:org.opensuse.security:def:30746	P	Security update for ansible (Moderate)	2020-12-01
oval:org.opensuse.security:def:28102	P	Security update for git (Important)	2020-12-01
oval:org.opensuse.security:def:33412	P	Security update for Salt (Moderate)	2020-12-01
oval:org.opensuse.security:def:31394	P	Security update for patch (Important)	2020-12-01
oval:org.opensuse.security:def:30745	P	Security update for ansible, python-straight-plugin (Moderate)	2020-12-01
oval:org.opensuse.security:def:28045	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:33363	P	Security update for openssl1 (Important)	2020-12-01
oval:org.opensuse.security:def:27961	P	Security update for ImageMagick (Important)	2020-12-01
oval:org.opensuse.security:def:33306	P	yast2-core on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27833	P	Security update for mercurial	2020-12-01
oval:org.opensuse.security:def:33150	P	libgcc_s1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27769	P	Security update for java-1_6_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:27758	P	Security update for gnutls	2020-12-01
oval:org.opensuse.security:def:27757	P	Security update for glibc (Important)	2020-12-01
oval:org.opensuse.security:def:29320	P	Security update for IBM Java 1.4.2	2020-12-01
oval:org.opensuse.security:def:32776	P	python on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29266	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:34723	P	Security update for ImageMagick (Important)	2020-12-01
oval:com.ubuntu.trusty:def:20149637000	V	CVE-2014-9637 on Ubuntu 14.04 LTS (trusty) - medium.	2017-08-25
oval:com.ubuntu.precise:def:20149637000	V	CVE-2014-9637 on Ubuntu 12.04 LTS (precise) - medium.	2014-12-31

BACK