Skip to content
OpenAdvisories
High DLA-1107-1 2 CVEs

bzr - security update

Published Sep 23, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 bzr 2.6.0~bzr6526-1+deb7u1

Vulnerabilities 2

  • High 8.8
    CVE-2017-14176

    Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

    Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-20…

    bzr breezy bzr bzr Debian Ubuntu PyPI
  • Unscored —
    CVE-2013-2099

    Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspec…

    python-tornado python-urllib3 bzr w3af Debian Ubuntu