CVE-2018-1000156: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2018-1000156 is a high (CVSS 7.8) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 5.33% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 06-04-2018PublishedVulnerability first disclosed.
- 14-04-2025Last modifiedVulnerability information updated.
Description
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.33%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.33% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.4 | 6.5 | 6.6 | 7.2 | 7.3 | 7.4 | 7.6
- enterprise_linux_server_eus6.7 | 7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus6.6 | 7.2 | 7.3 | 7.4 | 7.6
Debian2 products
- patch< 2.7.6-2 | < 2.6.1-3+deb7u1
- debian_linuxEOL7.0
Alpine1 product
- patch< 2.7.6-r6 | < 2.7.6-r0 | < 2.7.6-r4
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.10
Chainguard1 product
- patch< 2.7.6-r3
Gnu1 product
- patch2.7.6
Ubuntu1 product
- patch< 2.7.1-4ubuntu2.4 | < 2.7.5-1ubuntu0.16.04.1
Wolfi1 product
- patch< 2.7.6-r3
8 vendors · 16 products
References
41 linksShow all 41 references
- twitter.com/kurtseifried/status/982028968877436928X Refsource MISCX TransferredThird Party AdvisoryREPORTAdvisory
