Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:4190-1 Final 1 1 2018-12-19T13:16:49Z current 2018-12-19T13:16:49Z 2018-12-19T13:16:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: Security issue fixed: - CVE-2018-19486: Fixed git that executed commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was (bsc#1117257). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Basesystem-15-2018-2990,SUSE-SLE-Module-Development-Tools-15-2018-2990,SUSE-SLE-Module-Development-Tools-OBS-15-2018-2990 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20184190-1/ Link for SUSE-SU-2018:4190-1 https://lists.suse.com/pipermail/sle-security-updates/2018-December/004983.html E-Mail link for SUSE-SU-2018:4190-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1117257 SUSE Bug 1117257 https://www.suse.com/security/cve/CVE-2018-19486/ SUSE CVE CVE-2018-19486 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Development Tools 15 git-core-2.16.4-3.9.2 git-2.16.4-3.9.2 git-arch-2.16.4-3.9.2 git-cvs-2.16.4-3.9.2 git-daemon-2.16.4-3.9.2 git-doc-2.16.4-3.9.2 git-email-2.16.4-3.9.2 git-gui-2.16.4-3.9.2 git-svn-2.16.4-3.9.2 git-web-2.16.4-3.9.2 gitk-2.16.4-3.9.2 git-core-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 git-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-arch-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-cvs-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-daemon-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-doc-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-email-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-gui-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-svn-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 git-web-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 gitk-2.16.4-3.9.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017. CVE-2018-19486 SUSE Linux Enterprise Module for Basesystem 15:git-core-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-arch-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-cvs-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-daemon-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-doc-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-email-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-gui-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-svn-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:git-web-2.16.4-3.9.2 SUSE Linux Enterprise Module for Development Tools 15:gitk-2.16.4-3.9.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20184190-1/ https://www.suse.com/security/cve/CVE-2018-19486.html CVE-2018-19486 https://bugzilla.suse.com/1117257 SUSE Bug 1117257