SUSE SLES12 Security Update : git (SUSE-SU-2017:2747-1)

This update for git fixes the following issues: This security issue was fixed : - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041. Note that Tenable...

SUSE-SU-2017:2747-1 Security update for git

This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041...

Fedora Update for perl FEDORA-2017-2008fdd7e2

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 25 Update: perl-5.24.3-389.fc25

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Exploits

Exploits Containing Self Made Perl Reproducers / PoC Codes -...

Amazon Linux AMI : git (ALAS-2017-910)

The 'git' subcommand 'cvsserver' is a Perl script which makes excessive use of the backtick operator to invoke 'git'. Unfortunately user input is used within some of those invocations. It should be noted, that 'git-cvsserver' will be invoked by 'git-shell' by default without further configuration...

Fedora Update for perl FEDORA-2017-89492f7161

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Critical Photon OS Security Update - PHSA-2017-0076

Updates of 'ruby', 'krb5', 'perl' packages of Photon OS have been released...

Fedora 26 : 4:perl (2017-89492f7161)

Update perl:MODULECOMPAT ---- Security fix for CVE-2017-12837 CVE-2017-12883 see Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

openSUSE Security Update : git (openSUSE-2017-1115)

This update for git to version 2.13.6 fixes the following issues : - CVE-2017-14867: Various Perl scripts did not use safepipecapture instead of backticks, leaving them susceptible to end-user input boo1061041 As an additional measure, 'git cvsserver' no longer is invoked by 'git daemon' by...

Debian DLA-1120-1 : git security update

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support ha...

[SECURITY] [DLA 1120-1] git security update

Package : git Version : 1:1.7.10.4-1+wheezy6 CVE ID : CVE-2017-14867 Debian Bug : 876854 joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The...

[SECURITY] Fedora 26 Update: perl-5.24.3-395.fc26

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

[SECURITY] Fedora 27 Update: perl-5.26.1-401.fc27

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

DEBIAN-CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

Design/Logic Flaw

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

BSA-2017-437

Security Advisory ID : BSA-2017-437 Component : Perl Revision : 2.0: Interim Buffer overflow in the regular expression parser in PERL before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service crash or leak data from memory via vectors involving use...

Fedora 26 : git (2017-9b35152c83)

These releases are about hardening git shell that is used on servers against an unsafe user input, which git cvsserver copes with poorly. From the release notes : - 'git cvsserver' no longer is invoked by 'git shell' by default, as it is old and largely unmaintained. - Various Perl scripts did no...

BSA-2017-436

Security Advisory ID : BSA-2017-436 Component : Perl Revision : 2.0: Interim Heap-based buffer overflow in the regular expression compiler in PERL before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service crash via a crafted regular expression with the...