Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0027
git security update
6 January 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: git
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-7545
Reference: ESB-2015.3080
Original Bulletin:
http://www.debian.org/security/2016/dsa-3435
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3435-1 security@debian.org
https://www.debian.org/security/ Laszlo Boszormenyi (GCS)
January 05, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : git
CVE ID : CVE-2015-7545
Blake Burkhart discovered that the Git git-remote-ext helper incorrectly
handled recursive clones of git repositories. A remote attacker could
possibly use this issue to execute arbitary code by injecting commands
via crafted URLs.
For the oldstable distribution (wheezy), this problem has been fixed
in version 1:1.7.10.4-1+wheezy2.
For the stable distribution (jessie), this problem has been fixed in
version 1:2.1.4-2.1+deb8u1.
For the testing distribution (stretch), this problem has been fixed
in version 1:2.6.1-1.
For the unstable distribution (sid), this problem has been fixed in
version 1:2.6.1-1.
We recommend that you upgrade your git packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJWjC+sAAoJEAVMuPMTQ89EmmgQAI4VBcUvPYHI/zCiVuyI4bct
lCqWmgLZqWAt7ejm2P6yDCv74G8oyJ4aALaKG2S+rqRFussiDjVTMhcouW/sLITt
SVRhkeDfhyE3gZr/pRgc2J5Rs5hAbtK7fnv4uKIbw4k+s1UTexuamPjhBQMyWhN8
ar6/V5ESe63hUIVzOgljz4brFvw3F1g3xrZXXT6za5ceAK39wAXLXzUTTSF+R+DB
Sxv60xg5KO7OA3W8VWDeKkoH6SjrNoY/XZldVK6Aqy+VeTAhJndKUc1djy6TNhJF
a5dj0rgVQvv1Mk2j5p84tYRrAxDJeBlIKF00Bd6M/MAPxumHuoc/aIRIvOCkOuQl
FYiVXfL8jZzeEk3pYYm7L9qO6Sc3YesW0cRHaFrnDo45ZJ5PkrJ2jqRbpTzl8xA3
El5el6rzHwRaK8ZtgpbD1msU8ZCgLTVNDh5gwGQYIojAp9djM+GudR0l8Yxwwj/0
bUxXcECVKvtfp/qTJOJvirANhpT94jSb+1a9SJq9rkPcJr0qgniq85MsrRSPpcxA
ZjxN2T2IWQxokgLJh8jT9LCyCLI3e0za3kVqygv+hKdmbXE4hrLgBGsInpXsKsMV
opv6hvFSMzwj9e4q+YjRHQ9BEAYOlbNQz2t1XgQNrhze4ZO4iZ7COJqobgs/bT2+
nF54rbZ1Z58WtZaYgOo8
=kWP3
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVoxnz36ZAP0PgtI9AQIhbg//daOai9ZzBd+DvkfHxfOkm5k0dhWvZS8s
33M9xd0H4Z88pQhIl7v75SQedS72Z2IbY+/lJRtxO7kSGsVDRsISIwdPZVlMC1R4
Tp5xNlHcwkCH3YriBcUWcswUA6pjGer9NxgRet720FNUTtGGkMsIMPZIx8Xmy4AC
xQTRQxs5qjOfMSis9dUl8BSiAgRS9ENrfxtTZdBOu82U4IHjsSoJ+nosScxcb8Zz
vM2EwuH0mwxjP5NCwpHWT5+isEeoV4XAW8iYaWeYNVeSs0Iy22ceZILkRNVLwm+n
P7G30BGpAJ77aKGy2wbHr+c2VdbIu6CII+j9DXuZ8IvZsPjelxF/imIQx4lkkY1w
6V5h/7/9D42VRNkS/Ha0wSH8dMOdXIR/wI7Js8fPfrCPgWhJuNmcp53H59/hxurm
WfQYpVkjv30O/Uec5jsl+4y4wXx8E7+eMjdmmBvxoU6/RadQDHnWLS8/ixt2iuj8
bOk2dksndPaGIdQlr/O2H0d69Gt1wCMMeAUOaNJTGE/WlUYDN4ykTXC8wBTSobLr
36VA43ZLzGpc91eDOlKJJtkNYQi37bnYj/H196LyuaA/Z5jihr7DjHq/xY8OdfOb
c8qrMf0CrJmb6AvIcQ4xupNOV+q629CJo7bgQyIVsHpBPqY9N4LzFqApTE43B995
rL1tC/w9338=
=xUr1
-----END PGP SIGNATURE-----