USN-3411-1
bzr vulnerability
Adam Collard discovered that Bazaar did not properly handle host names in 'bzr+ssh://' URLs. A remote attacker could use this to construct a bazaar repository URL that when accessed could run arbitrary code with the privileges of the user.
What each source reports
OSV No score
bzr vulnerability
Adam Collard discovered that Bazaar did not properly handle host names in 'bzr+ssh://' URLs. A remote attacker could use this to construct a bazaar repository URL that when accessed could run arbitrary code with the privileges of the user.
- Record
USN-3411-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bzrUbuntu:14.04:LTS |
before 2.6.0+bzr6593-1ubuntu1.6, plus listed versions 2.6.0-3ubuntu12.6.0-3ubuntu22.6.0+bzr6591-1ubuntu12.6.0+bzr6593-1ubuntu12.6.0+bzr6593-1ubuntu1.12.6.0+bzr6593-1ubuntu1.5 |
2.6.0+bzr6593-1ubuntu1.6 |
bzrUbuntu:16.04:LTS |
before 2.7.0-2ubuntu3.1, plus listed versions 2.6.0+bzr6602-2ubuntu42.6.0+bzr6606-2ubuntu12.7.0-2ubuntu12.7.0-2ubuntu22.7.0-2ubuntu3 |
2.7.0-2ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-3411-1 is a vulnerability with no CVSS score yet in bzr, published September 6, 2017. No source lists public exploit code. Fixed in bzr 2.6.0+bzr6593-1ubuntu1.6.