30 Mai
2018
30 Mai
'18
22:38
apticron report [Wed, 30 May 2018 22:38:05 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
quigon.federez.net
[ 160.228.155.65 ]
The following packages are currently pending an upgrade:
git 1:2.11.0-3+deb9u3
git-man 1:2.11.0-3+deb9u3
gitweb 1:2.11.0-3+deb9u3
========================================================================
Package Details:
apt-listchanges : Lecture des fichiers de modifications (« changelog »)...
apt-listchanges : journaux des modifications (« changelogs »)
-------------------------------------------------------------
--- Modifications pour git (git git-man gitweb) ---
git (1:2.11.0-3+deb9u3) stretch-security; urgency=high
* Fix CVE-2018-11235, arbitrary code execution via submodule names
in .gitmodules file:
- submodule: verify submodule names as paths
- fsck: simplify ".git" check
- fsck: fsck blob data
- fsck: detect .gitmodules files
- fsck: check .gitmodules content
- fsck: call fsck_finish after fscking objects
- unpack-objects: call fsck_finish after fscking objects
- index-pack: check .gitmodules files with --strict
* Fix CVE-2018-11233, out-of-bounds read when validing NTFS paths:
- is_ntfs_dotgit: use a size_t for traversing string
* Do not allow .gitmodules to be a symlink:
- is_hfs_dotgit: match other .git* files
- is_ntfs_dotgit: match other .git* files
- is_{hfs,ntfs}_dotgitmodules: add tests
- skip_prefix: add case-insensitive variant
- verify_path: drop clever fallthrough
- verify_dotfile: mention case-insensitivity in comment
- update-index: stat updated files earlier
- verify_path: disallow .gitmodules symlinks
- fsck: complain when .gitmodules is a symlink
* debian/rules: make the new test executable.
Thanks to Brandon Williams, Etienne Stalmans, and Jeff King for
discovering and reporting these vulnerabilities and to Jeff King
and Johannes Schindelin for fixing them.
-- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 27 May 2018 10:48:46 -0700
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on quigon.federez.net
--
apticron