CVE-2018-1000156

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

• CWE-20

• http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
• http://rachelbythebay.com/w/2018/04/05/bangpatch/Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1199Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1200Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2091Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2092Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2093Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2094Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2095Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2096Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2097Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/04/msg00013.htmlMailing List, Third Party Advisory
• https://savannah.gnu.org/bugs/index.php?53566Vendor Advisory
• https://seclists.org/bugtraq/2019/Aug/29
• https://seclists.org/bugtraq/2019/Jul/54
• https://security.gentoo.org/glsa/201904-17Third Party Advisory
• https://usn.ubuntu.com/3624-1/Third Party Advisory
• https://usn.ubuntu.com/3624-2/Third Party Advisory
• https://web.archive.org/web/20180405231329/https://twitter.com/kurtseifried/status/982028968877436928
• http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
• http://rachelbythebay.com/w/2018/04/05/bangpatch/Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1199Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1200Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2091Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2092Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2093Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2094Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2095Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2096Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2097Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/04/msg00013.htmlMailing List, Third Party Advisory
• https://savannah.gnu.org/bugs/index.php?53566Vendor Advisory
• https://seclists.org/bugtraq/2019/Aug/29
• https://seclists.org/bugtraq/2019/Jul/54
• https://security.gentoo.org/glsa/201904-17Third Party Advisory
• https://twitter.com/kurtseifried/status/982028968877436928Third Party Advisory
• https://usn.ubuntu.com/3624-1/Third Party Advisory
• https://usn.ubuntu.com/3624-2/Third Party Advisory

Published

Apr 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000150An exposure of sensitive information vulnerability exists in…
• CVE-2018-1000151A man in the middle vulnerability exists in Jenkins vSphere …
• CVE-2018-1000152An improper authorization vulnerability exists in Jenkins vS…
• CVE-2018-1000153A cross-site request forgery vulnerability exists in Jenkins…
• CVE-2018-1000154Zammad GmbH Zammad version 2.3.0 and earlier contains a Impr…
• CVE-2018-1000155OpenFlow version 1.0 onwards contains a Denial of Service an…
• CVE-2018-1000157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000158cmsmadesimple version 2.2.7 contains a Incorrect Access Cont…
• CVE-2018-1000159tlslite-ng version 0.7.3 and earlier, since commit d7b288316…
• CVE-2018-1000160RisingStack protect version 1.2.0 and earlier contains a Cro…
• CVE-2018-1000161nmap version 6.49BETA6 through 7.60, up to and including SVN…
• CVE-2018-1000162Parsedown version prior to 1.7.0 contains a Cross Site Scrip…