blob: 343e5b0dc15e9f51fe69b323308a4c3cb13e67ae [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<glsa id="201605-01">
<title>Git: Multiple vulnerabilities</title>
<synopsis>Git contains multiple vulnerabilities that allow for the remote
execution of arbitrary code.
<product type="ebuild"></product>
<announced>May 02, 2016</announced>
<revised>May 02, 2016: 1</revised>
<package name="dev-vcs/git" auto="yes" arch="*">
<unaffected range="ge">2.7.3-r1</unaffected>
<vulnerable range="lt">2.7.3-r1</vulnerable>
<p>Git is a free and open source distributed version control system
designed to handle everything from small to very large projects with
speed and efficiency.
<p>Git is vulnerable to the remote execution of arbitrary code by cloning
repositories with large filenames or a large number of nested trees.
Additionally, some protocols within Git, such as git-remote-ext, can
execute arbitrary code found within URLs. These URLs that submodules use
may come from arbitrary sources (e.g., .gitmodules files in a remote
repository), and can effect those who enable recursive fetch. Restrict
the allowed protocols to well known and safe ones.
<impact type="normal">
<p>Remote attackers could execute arbitrary code on both client and server.</p>
<p>There is no known workaround at this time.</p>
<p>All Git users should upgrade to the latest version:</p>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/git-2.7.3-r1"
<uri link="">Buffer overflow in all
git versions before 2.7.1
<uri link="">CVE-2015-7545</uri>
<uri link="">
<uri link="">
<metadata tag="requester" timestamp="Mon, 21 Dec 2015 19:36:07 +0000">
<metadata tag="submitter" timestamp="Mon, 02 May 2016 19:28:17 +0000">b-man</metadata>