CVE-2015-0778

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

These are all security issues fixed in the osc-0.155.1-2.1 package on the GA media of openSUSE Tumbleweed.

osc was updated to fix a security issue and some non-security bugs.

osc was updated to 0.151.0, fixing the following vulnerability:

• fixed shell command injection via crafted _service files CVE-2015-0778 boo#901643

The following non-security bugs were fixed:

• fix times when data comes from OBS backend
• support updateing the link in target package for submit requests
• various minor bugfixes

This update provides osc 0.152.0 with various fixes and improvements.

This security issue was fixed:

• CVE-2015-0778: Shell command injection via crafted _service files. (bsc#901643)

For a comprehensive list of changes, please refer to the package's change log.