31–40 of 385 posts
Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.
Sure, but your /usr/bin/git is still vulnerable. You're one config mistake (or maybe running a "malicious" script) away from executing.
I got the updated brew version downloaded already.
Did Apple not backport the security fixes to the version of git they ship?
https://opensource.apple.com/source/Git/Git-58/src/git/revis...
Function is path_name, nlen type should be size_t and there shouldn't be integer overflow in the first loop.
Earlier quoted context omitted.
Sure, but your /usr/bin/git is still vulnerable. You're one config mistake (or maybe running a "malicious" script) away from executing.
How do I replace /usr/bin/git? I got the updated brew version downloaded already.
Do this to disable it:
sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/gitEarlier quoted context omitted.
Sure, but your /usr/bin/git is still vulnerable. You're one config mistake (or maybe running a "malicious" script) away from executing.
I'm pretty sure git isn't the only thing that is (or will be) vulnerable. Vulnerabilities happen, it's a fact of life. You will have to constantly update your systems no matter which OS you run.
$ brew install git $ git --version git version 2.8.1
Weird, I got git 2.6.1 using the same command: $ brew install git ==> Downloading https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bo... $ git version git version 2.6.1 $ brew upgrade git Error: git 2.6.1 already installed
brew update
brew upgrade gitDid Apple not backport the security fixes to the version of git they ship?
Looks like no: https://opensource.apple.com/source/Git/Git-58/src/git/revis... Function is path_name, nlen type should be size_t and there shouldn't be integer overflow in the first loop.
Edit:
OK, Xcode 7.2 security notes mentions Git vulnerability CVE-2015-7082 (older than the ones in questions), and Xcode 7.3 doesn't mention any fixed vulnerabilities in Git, so I guess it's vulnerable and NOT patched.
Earlier quoted context omitted.
How do I replace /usr/bin/git? I got the updated brew version downloaded already.
This is in the linked post. Do this to disable it: sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git
chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory
Earlier quoted context omitted.
Except that git is used specifically by users who are downloading and compiling software.
And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"
There are prebuilt binaries of up to date git distributed via .pkg. The yeast infection that is Homebrew is unnecessary
$ brew install git $ git --version git version 2.8.1
Weird, I got git 2.6.1 using the same command: $ brew install git ==> Downloading https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bo... $ git version git version 2.6.1 $ brew upgrade git Error: git 2.6.1 already installed