BugTraq
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished á´?á´ á´?-2016-2324 and á´?á´ á´?â??2016â??2315) Mar 18 2016 08:59AM
Laël Cellier (lael cellier laposte net)
Oh?????????? Big mistake. I might advertised too soon.

I saw changes were pushed in master, so I thought the next version
(which was 2.7.1) would be the one which will include the fix.
But as pointed out on
https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions
including the fixes were released yet, and even 2.7.3 still include
path_name(). I didn?t checked the code (Sorrrry).

So the only way to fix it is to draw your compilers and compile the
current master branch at https://git.kernel.org/cgit/git/git.git/.
Or do like github did by using the patches at
http://thread.gmane.org/gmane.comp.version-control.git/286253 and
http://thread.gmane.org/gmane.comp.version-control.git/286008

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus