CVE-2015-7545
- State
- Published
- Severity
- Not scored
- Published
- Apr 13, 2016
- Updated
- Aug 6, 2024
- Reserved
- Sep 29, 2015
Description
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2015:2515vendor-advisory
- openSUSE-SU-2015:1968vendor-advisory
- GLSA-201605-01vendor-advisory
- [oss-security] 20151208 CVE for git issue - please use CVE-2015-7545mailing-list
- [linux-kernel] 20151005 [ANNOUNCE] Git v2.6.1, v2.5.4, v2.4.10 and v2.3.10mailing-list
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1034501vdb-entry
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1269794
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt
- USN-2835-1vendor-advisory
- https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt
- [oss-security] 20151211 Re: CVE for git issue - please use CVE-2015-7545mailing-list
- 78711vdb-entry
- [oss-security] 20151209 Re: CVE for git issue - please use CVE-2015-7545mailing-list
- https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt
- SSA:2016-123-01vendor-advisory
- DSA-3435vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.