Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1086
_____________________________________________________________________

DATE                : 27/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running GNU patch versions prior to
                                         2.8.1.

====================================================================
https://lists.gnu.org/archive/html/bug-patch/2026-10/msg00014.html
_____________________________________________________________________
 
GNU patch 2.8.1 released
From: 	Andreas Grünbacher
Subject: 	GNU patch 2.8.1 released
Date: 	Fri, 23 Oct 2026 15:00:49 +0200

GNU patch 2.8.1 has been released to fix the following critical bug:

>    Prevent creation of out-of-tree files (CVE-2026-115207)
>
>    When reverse-applying a patch that deletes a file, patch created that
>    file without checking if the pathname is safe.  Fix that by adding the
>    missing check.

The project page is at https://savannah.gnu.org/projects/patch/

The sources can be downloaded from https://ftp.gnu.org/gnu/patch/

The sha256sum checksums are as follows:

> a6ab04d926d6a624832a8ce19ea4e77c76742abf14cb7bca33fea010b7fa9842  
> patch-2.8.1.tar.bz2
> 0f7b43c7ea450c5d3e9eaf8301177628bc0171d580b2bd6a72822409767144ff  
> patch-2.8.1.tar.gz
> 3240c7959c5347c8ed347e3c4201c0337bf4240d5cf09d68889e58eeaba30e17  
> patch-2.8.1.tar.xz

This release is also GPG signed. You can download the signature by
appending '.sig' to the URL. If the 'gpg --verify' command fails
because you don't have the required public key, then run this command
to import it:

  gpg --recv-keys D5BF9FEB0313653A

Key fingerprint = 259B 3792 B3D6 D319 212C  C4DC D5BF 9FEB 0313 653A

Regards,
Andreas Gruenbacher





=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================