News for hackers. Stuff that matters.

A comment on Remote code execution, git, and OS X. Parent comment

Re:Remote code execution, git, and OS X by atdt on Monday April 18, 2016 @02:56AM (#11518146)
If things are tied up in QA, that is a problem in and of itself, because relevance is an important quality for a security bugfix to have. If my system is compromised today, it will do me little good that the bugfix Apple ships next month was tested extensively for compatibility with Xcode.

It is too late for there to be an expedient update from Apple. The vulnerability was disclosed to oss-security over a month ago, on March 15[0]. SUSE had a patch out the next day[1]. By March 24, Debian, Ubuntu, Red Hat, CentOS and Oracle had all issued fixes.[2]

[0]: http://www.openwall.com/lists/oss-security/2016/03/15/5

[1]: http://lists.opensuse.org/opensuse-security-announce/2016-03...

[2]: http://www.securitytracker.com/id/1035290

[ Parent | on HN ]
Re:Remote code execution, git, and OS X by bronxbomber92 on Monday April 18, 2016 @03:39PM (#11522569)
I should clarify that I don't know why an update hasn't been pushed. I was only speculating why it might be taking so long.
[ Parent | on HN ]