Summary
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | bzr | 2.6.0+bzr6593-1ubuntu1.6 |
| Ubuntu · 16.04 LTS 16.04:LTS | bzr | 2.7.0-2ubuntu3.1 |
References
-
report
https://launchpad.net/bugs/1710979