Threats Tagged 'cve-2026-56289'

This security update addresses two vulnerabilities in the patch utility. CVE-2026-56288 involves a crafted unified-diff patch file that can cause a null pointer dereference. CVE-2026-56289 involves improper validation of hunk line offsets that can lead to denial of service. The vulnerabilities affect multiple specific versions of the patch utility, including various SUSE and Ubuntu package versions. The severity is assessed as low.

Two vulnerabilities in GNU patch utility were addressed in a security update. CVE-2026-56288 involves a crafted unified-diff patch file causing a NULL pointer dereference, leading to a denial of service (DoS) via a crash. CVE-2026-56289 concerns improper validation of hunk line offsets that can also cause a denial of service. The issues affect certain versions of the patch utility distributed by Red Hat and SUSE. A security update is available that fixes these vulnerabilities.

A security update has been released for Red Hat Hardened Images RPMs addressing CVE-2026-56289. This update includes patched versions of the 'patch' RPM for aarch64 and x86_64 architectures. The vulnerability is classified with medium severity and relates to a specific security flaw identified by Red Hat Product Security.

GNU patch contains a denial of service (DoS) vulnerability caused by improper validation of hunk line offsets in unified-diff input. A malicious patch file can specify an extremely large line number, causing the utility to enter an effectively infinite processing loop and consume excessive CPU resources. This results in the process becoming unresponsive and requiring manual termination. The issue has been fixed in a specific commit.

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9