Apple patches vulnerable OS X Git version that put developers at risk

From PC World: Apple has released a new version of its Xcode development tool in order to patch two critical vulnerabilities in the Git source code management client.

The Git vulnerabilities, CVE‑2016‑2324 and CVE‑2016‑2315, have been known since mid-March and can be exploited when cloning a repository with a specially crafted file structure. This allows attackers to execute malicious code on systems where such cloning operations were initiated.

Xcode is an integrated development environment (IDE) used by a large number of developers to write applications for OS X and iOS. It includes a package called the OS X Command Line Tools for Xcode that contains the open-source Git client.

The version of Git shipped with the command line tools package has now been updated to 2.7.4. This version was released by the Git developers on March 17, but it took Apple a month and a half to integrate into Xcode.

View: Article @ Source Site