CVE-2010-4651

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

• CWE-22

• http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1Patch
• http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055241.htmlPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055246.htmlPatch
• http://lists.gnu.org/archive/html/bug-patch/2010-12/msg00000.htmlPatch
• http://openwall.com/lists/oss-security/2011/01/05/10Patch
• http://openwall.com/lists/oss-security/2011/01/06/19Patch
• http://openwall.com/lists/oss-security/2011/01/06/20
• http://openwall.com/lists/oss-security/2011/01/06/21Patch
• http://secunia.com/advisories/43663Vendor Advisory
• http://secunia.com/advisories/43677Vendor Advisory
• http://support.apple.com/kb/HT4723
• http://www.securityfocus.com/bid/46768
• http://www.vupen.com/english/advisories/2011/0600Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=667529Patch
• http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1Patch
• http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055241.htmlPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055246.htmlPatch
• http://lists.gnu.org/archive/html/bug-patch/2010-12/msg00000.htmlPatch
• http://openwall.com/lists/oss-security/2011/01/05/10Patch
• http://openwall.com/lists/oss-security/2011/01/06/19Patch
• http://openwall.com/lists/oss-security/2011/01/06/20
• http://openwall.com/lists/oss-security/2011/01/06/21Patch
• http://secunia.com/advisories/43663Vendor Advisory
• http://secunia.com/advisories/43677Vendor Advisory
• http://support.apple.com/kb/HT4723
• http://www.securityfocus.com/bid/46768
• http://www.vupen.com/english/advisories/2011/0600Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=667529Patch

Published

Mar 11, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4645strtod.c, as used in the zend_strtod function in PHP 5.2 bef…
• CVE-2010-4646Cross-site scripting (XSS) vulnerability in Hastymail2 befor…
• CVE-2010-4647Multiple cross-site scripting (XSS) vulnerabilities in the H…
• CVE-2010-4648The orinoco_ioctl_set_auth function in drivers/net/wireless/…
• CVE-2010-4649Integer overflow in the ib_uverbs_poll_cq function in driver…
• CVE-2010-4650Buffer overflow in the fuse_do_ioctl function in fs/fuse/fil…
• CVE-2010-4652Heap-based buffer overflow in the sql_prepare_where function…
• CVE-2010-4653An integer overflow condition in poppler before 0.16.3 can o…6.5
• CVE-2010-4654poppler before 0.16.3 has malformed commands that may cause …7.8
• CVE-2010-4655net/core/ethtool.c in the Linux kernel before 2.6.36 does no…5.5
• CVE-2010-4656The iowarrior_write function in drivers/usb/misc/iowarrior.c…7.8
• CVE-2010-4657PHP5 before 5.4.4 allows passing invalid utf-8 strings via t…7.5