CVE-2022-39260 Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

Git is an open source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the...

CVE-2022-39260

Git Shell command-argument parsing bug (CVE-2022-39260) in pre-2.30.6…2.37.4 allows an attacker with SSH access to a Git shell login to overflow an int-based count when building the argv array, enabling arbitrary heap writes and potential remote code execution via execv(). Affected setups require...

CVE-2022-39260 Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

Git is an open source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the...

Slackware: Security Advisory (SSA:2022-291-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] git

New git packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/git-2.35.5-i586-1slack15.0.txz: Upgraded. This release fixes two security issues: CVE-2022-39253: When relying on the...

USN-5686-1: Git vulnerabilities

Cory Snider discovered that Git incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause an unexpected behaviour. CVE-2022-39253 Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to...

FreeBSD : git -- Multiple vulnerabilities (2523bc76-4f01-11ed-929b-002590f2a714)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2523bc76-4f01-11ed-929b-002590f2a714 advisory. - When relying on the --local clone optimization, Git dereferences symbolic links in the sourc...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current git Multiple Vulnerabilities (SSA:2022-291-01)

The version of git installed on the remote host is prior to 2.30.6 / 2.35.5 / 2.38.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-291-01 advisory. - When relying on the --local clone optimization, Git dereferences symbolic links in the source repository...

git -- Multiple vulnerabilities

This release contains 2 security fixes: CVE-2022-39253 When relying on the --local clone optimization, Git dereferences symbolic links in the source repository before creating hardlinks or copies of the dereferenced link in the destination repository. This can lead to surprising behavior where...

virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

An update is available for libguestfs, libnbd, libtpms, libguestfs-winsupport, nbdkit, supermin, libiscsi, hivex, libvirt, netcf, perl-Sys-Virt, seabios, qemu-kvm, swtpm, virt-v2v, sgabios, libvirt-dbus, libvirt-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS...

ALSA-2022:1759 Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

CVE-2021-39260 affecting package ntfs-3g for versions less than 2021.8.22-1

CVE-2021-39260 affecting package ntfs-3g for versions less than 2021.8.22-1. An upgraded version of the package is available that resolves this issue...

Debian DLA-2819-1 : ntfs-3g - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2819 advisory. - In NTFS-3G versions 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfsgetattributevalue, a heap buffer overflow can occur allowi...

[SECURITY] [DLA 2819-1] ntfs-3g security update

Debian LTS Advisory DLA-2819-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 16, 2021 https://wiki.debian.org/LTS Package : ntfs-3g Version : 1:2016.2.22AR.1+dfsg-1+deb9u2 CVE ID : CVE-2021-33285 CVE-2021-33286 CVE-2021-33287 CVE-2021-33289 CVE-2021-352...

RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2021:3704)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3704 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

RHEL 8 : virt:av and virt-devel:av (RHSA-2021:3703)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3703 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

Security fix for the ALT Linux 9 package ntfs-3g version 2:2021.8.22-alt1

2:2021.8.22-alt1 built Sept. 10, 2021 Valery Inozemtsev in task 284295 Aug. 31, 2021 Valery Inozemtsev - 2021.8.22 Fixes: CVE-2021-33285, CVE-2021-35269, CVE-2021-35268, CVE-2021-33289, CVE-2021-33286, CVE-2021-35266, CVE-2021-33287, CVE-2021-35267, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253,...

Debian: Security Advisory (DSA-4971-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4971-1] ntfs-3g security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4971-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 09, 2021 https://www.debian.org/security/faq -...

openSUSE: Security Advisory for ntfs-3g_ntfsprogs (openSUSE-SU-2021:2971-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...