From: Eric Sandall <eric@sandall.us>
To: Junio C Hamano <junkio@cox.net>
Cc: git@vger.kernel.org
Subject: Re: [ANNOUNCE] GIT 1.1.5
Date: Tue, 31 Jan 2006 09:38:19 -0800 (PST) [thread overview]
Message-ID: <Pine.LNX.4.63.0601310937490.29839@cerberus> (raw)
In-Reply-To: <7virs5x8im.fsf@assigned-by-dhcp.cox.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Fri, 27 Jan 2006, Junio C Hamano wrote:
> The latest maintenance release GIT 1.1.5 is available at the
> usual places:
>
> http://www.kernel.org/pub/software/scm/git/
>
> git-1.1.5.tar.{gz,bz2} (tarball)
> RPMS/$arch/git-*-1.1.5-1.$arch.rpm (RPM)
>
> Mark Wooding noticed that there is a bug in git-checkout-index
> to overflow its internal buffer, if you construct a blob that
> records an insanely long symbolic link in your index file and
> try to check it out. This makes it dump core or worse.
>
> The fix for this problem is the only change from v1.1.4. The
> master branch has been updated with the same fix (so has "pu").
>
>
> ---
>
> By the way, "dump core or worse" is a subtle way to say that
> this is a security fix. To be victimized, you have to somehow
> first get such a bogus symbolic link in your index. Merging
> with somebody of dubious trustworthiness is a way to do so;
> please practice safe merge ;-).
I've updated the Source Mage GNU/Linux package, thanks!
- -sandalle
- --
Eric Sandall | Source Mage GNU/Linux Developer
eric@sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFD36CPHXt9dKjv3WERAhpUAKCXdVE+RgUUEY2BGl2jf0Bicdo7lgCgu/PJ
yfRqXjYEzA8etWJBWQ+fK7E=
=4UVq
-----END PGP SIGNATURE-----
prev parent reply other threads:[~2006-01-31 17:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-01-28 4:48 [ANNOUNCE] GIT 1.1.5 Junio C Hamano
2006-01-31 17:38 ` Eric Sandall [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.63.0601310937490.29839@cerberus \
--to=eric@sandall.us \
--cc=git@vger.kernel.org \
--cc=junkio@cox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).