{"id":"MGASA-2017-0336","aliases":[],"status":"published","title":"Updated bzr packages fix security vulnerability","description":"Adam Collard discovered that Bazaar did not properly handle host names\nin 'bzr+ssh://' URLs. A remote attacker could use this to construct\na bazaar repository URL that when accessed could run arbitrary code\nwith the privileges of the user.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-09-10T12:36:09Z","modified":"2026-04-16T04:28:22Z","fixes":[{"ecosystem":"Mageia:5","package":"bzr","fixed_in":["2.6.0-11.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"bzr","fixed_in":["2.7.0-1.1.mga6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-11.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"bzr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.1.mga6"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2017-0336.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21681","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3411-1/","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2017-0336","title":"Updated bzr packages fix security vulnerability","description":"Adam Collard discovered that Bazaar did not properly handle host names\nin 'bzr+ssh://' URLs. A remote attacker could use this to construct\na bazaar repository URL that when accessed could run arbitrary code\nwith the privileges of the user.\n","status":"published","published":"2017-09-10T12:36:09Z","modified":"2026-04-16T04:28:22.43548Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}