Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 597
Alerts This Week
Warning Icon 1 597

Debian: DSA-3206-1 Moderate: Dulwich Code Execution Threat

debian
Calendar Grey March 28, 2015
Debian Logo
- ------------------------------------------------------------------------- Debian Security Advisory
Multiple vulnerabilities have been discovered in Dulwich, a Python implementation of the file formats and protocols used by the Git version control system
Topics%20covered

Topics Covered

security advisory moderate buffer overflow code execution debian dulwich

Summary

CVE-2014-9706

It was discovered that Dulwich allows writing to files under .git/
when checking out working trees. This could lead to the execution of
arbitrary code with the privileges of the user running an
application based on Dulwich.

CVE-2015-0838

Ivan Fratric of the Google Security Team has found a buffer
overflow in the C implementation of the apply_delta() function,
used when accessing Git objects in pack files. An attacker could
take advantage of this flaw to cause the execution of arbitrary
code with the privileges of the user running a Git server or client
based on Dulwich.

For the stable distribution (wheezy), these problems have been fixed in
version 0.8.5-2+deb7u2.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 0.9.7-3.

For the unstable distribution (sid), these problems have been fixed in
version 0.10.1-1.

We recommend that you upgrade your dulwich packages.

Further information about Debian Security Advisor...

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Package: dulwich
CVE ID: CVE-2014-9706 CVE-2015-0838

Topics%20covered

Topics Covered

security advisory moderate buffer overflow code execution debian dulwich

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.