MGASA-2017-0336
Updated bzr packages fix security vulnerability
Adam Collard discovered that Bazaar did not properly handle host names in 'bzr+ssh://' URLs. A remote attacker could use this to construct a bazaar repository URL that when accessed could run arbitrary code with the privileges of the user.
What each source reports
OSV No score
Updated bzr packages fix security vulnerability
Adam Collard discovered that Bazaar did not properly handle host names in 'bzr+ssh://' URLs. A remote attacker could use this to construct a bazaar repository URL that when accessed could run arbitrary code with the privileges of the user.
- Record
MGASA-2017-0336- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2017-0336 is a vulnerability with no CVSS score yet in bzr, published September 10, 2017. No source lists public exploit code. Fixed in bzr 2.6.0-11.1.mga5.