CVE-2019-20633

Low

Published: —Translated: 16/07/2026(UTC)NVD NIST

Summary

In GNU patch through version 2.7.6, there is a double free vulnerability in the another_hunk function in pch.c, which can cause a denial of service via a crafted patch file. This issue exists because of an incomplete fix for CVE-2018-6952.

Risk Assessment

An attacker can exploit this vulnerability to crash the patch process, potentially disrupting systems that rely on automated patching.

Recommendation

It is recommended to upgrade GNU patch to version 2.7.6 or later, which includes a complete fix for this issue.

Original NVD description (English source)

GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.