CVE ID:	CVE-2019-13638
Description:	GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-13638 Bugtraq: 20190730 [SECURITY] [DSA 4489-1] patch security update (Google Search) https://seclists.org/bugtraq/2019/Jul/54 Bugtraq: 20190816 Details about recent GNU patch vulnerabilities (Google Search) https://seclists.org/bugtraq/2019/Aug/29 Debian Security Information: DSA-4489 (Google Search) https://www.debian.org/security/2019/dsa-4489 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/ https://security.gentoo.org/glsa/201908-22 http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0 https://github.com/irsl/gnu-patch-vulnerabilities https://security-tracker.debian.org/tracker/CVE-2019-13638 RedHat Security Advisories: RHSA-2019:2798 https://access.redhat.com/errata/RHSA-2019:2798 RedHat Security Advisories: RHSA-2019:2964 https://access.redhat.com/errata/RHSA-2019:2964 RedHat Security Advisories: RHSA-2019:3757 https://access.redhat.com/errata/RHSA-2019:3757 RedHat Security Advisories: RHSA-2019:3758 https://access.redhat.com/errata/RHSA-2019:3758 RedHat Security Advisories: RHSA-2019:4061 https://access.redhat.com/errata/RHSA-2019:4061