Skip to content
OpenAdvisories
High DSA-4052-1 1 CVE

bzr - security update

Published Nov 29, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 8 bzr 2.6.0+bzr6595-6+deb8u1
Debian · 9 bzr 2.7.0+bzr6619-7+deb9u1

Vulnerabilities 1

  • High 8.8
    CVE-2017-14176

    Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

    Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-20…

    bzr breezy bzr bzr Debian Ubuntu PyPI