First Last Prev Next    This bug is not in your last search results.
Bug 37395 - git: Multiple issues (3.2)
git: Multiple issues (3.2)
Status: CLOSED WONTFIX
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P5 minor (vote)
: UCS 3.2-x-errata
Assigned To: Security maintainers
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2014-12-19 08:45 CET by Moritz Muehlenhoff
Modified: 2019-04-11 19:24 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Moritz Muehlenhoff univentionstaff 2014-12-19 08:45:34 CET 
If git is used on a filesystem that is case-insensitive (i.e. NFTS, VFAT or HFS) and if the user is tricked into cloning or accessing a malformed repository, this could lead to an attacker overwriting  the .git/config file, resulting in the execution of arbitrary commands (CVE-2014-9390)

Such filesystems are uncommon in UCS, so low impact.
Comment 1 Arvid Requate univentionstaff 2016-03-17 11:35:12 CET 
* "int" is the wrong data type for ... nlen assignment (CVE-2016-2315)
* integer overflow due to a loop which adds more to "len" (CVE-2016-2324)
Comment 2 Arvid Requate univentionstaff 2017-05-23 18:55:54 CEST 
UCS 3.2 is out of maintenance and this package is not covered in any of the extended security scenarios.
First Last Prev Next    This bug is not in your last search results.