CVE-2015-7545

Publicada em 13 abr 2016 · Atualizada em 06 ago 2024

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 19%

probabilidade de exploração

19%top 3% das CVEs

exploração observada

nãonenhuma fonte reporta

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Produtos afetados

n/a · n/a

Referências

http://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html http://rhn.redhat.com/errata/RHSA-2015-2515.html https://bugzilla.redhat.com/show_bug.cgi?id=1269794 https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021 https://lkml.org/lkml/2015/10/5/683 https://security.gentoo.org/glsa/201605-01 http://www.debian.org/security/2016/dsa-3435 http://www.openwall.com/lists/oss-security/2015/12/08/5