Memory corruption in patch (Alpine package)

1) Memory corruption

EUVDB-ID: #VU10656

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10713

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to out-of-bounds access within pch_write_line() in pch.c. A local attacker can supply a specially crafted input, trigger memory corruption and cause the system to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

patch (Alpine package): 2.7.5-r2

CPE2.3

• cpe:2.3:a:alpine:patch_alpine_package:2.7.5-r2:*:*:*:*:alpine_linux:*:3.3

External links

https://git.alpinelinux.org/aports/commit/?id=41a24dac7ccf8c69b0e3b4b4409a736aefb3dfd5
https://git.alpinelinux.org/aports/commit/?id=7b507d3e2665bd8c0a6bdb5391230a039ad12de3
https://git.alpinelinux.org/aports/commit/?id=84c727e632d68b6ae25b713e7fc3c6c9fda3aae5
https://git.alpinelinux.org/aports/commit/?id=c1e3fa7f5f3303a13a62d5485d7d3c8cc752ecf3
https://git.alpinelinux.org/aports/commit/?id=58fc65d2b14f59efea945f9dc2dc39d9db45d72e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.