Advisories » MGASA-2017-0284

Updated cvs package fixes security vulnerability

Publication date: 19 Aug 2017
Modification date: 19 Aug 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-12836

Description

It was discovered that CVS, a centralised version control system, did not
correctly handle maliciously constructed repository URLs, which allowed an
attacker to run an arbitrary shell command (CVE-2017-12836).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21504
• https://www.debian.org/security/2017/dsa-3940
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12836

SRPMS

5/core

• cvs-1.12.13-25.1.mga5

6/core

• cvs-1.12.13-26.1.mga6