Last week, patch-2.7.3 was released fixing CVE-2015-1196. Both Fedora 20
and Fedora 21 have testing updates:
The fix prevents patches applying if they are for symbolic links with a
target containing the ".." pathname component:
Please be aware that some legitimate patches may fail as a result, until
a better fix can be found.