Ubuntu 15.10 USN-2835-1 Critical: Git Remote Code Execution Risk

ubuntu

December 15, 2015

Git could be made to run programs as your login if it processed an untrusted repository.

Summary

Git could be made to run programs as your login if it processed an

untrusted repository.

Software Description:

- git: fast, scalable, distributed revision control system

Details:

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly

handled recursive clones of git repositories. A remote attacker could

possibly use this issue to execute arbitrary code by injecting commands

via crafted URLs.

Topics Covered

security advisory update code execution remote code execution Ubuntu program execution git

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  git                             1:2.5.0-1ubuntu0.1

Ubuntu 15.04:
  git                             1:2.1.4-2.1ubuntu0.1

Ubuntu 14.04 LTS:
  git                             1:1.9.1-1ubuntu0.2

Ubuntu 12.04 LTS:
  git                             1:1.7.9.5-1ubuntu0.2

In general, a standard system update will make all the necessary changes.