Most recent entries from all

bdu:2024-04878

BIT-composer-2024-35241 — Composer vulnerable to command injection via malicious git branch name

Affected: Bitnami: composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

certfr-2025-avi-0836 — De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Elles permettent à un attaquant de provoq…

certfr-2025-avi-0836

CLEANSTART-2024-ND02975 — Composer is a dependency manager for PHP

Affected: CleanStart: composer

Security vulnerability affects the composer package. Composer is a dependency manager for PHP.

EUVD-2026-232172

fkie_cve-2024-35241

GHSA-47f6-5gq3-vx9c — Composer has a command injection via malicious git branch name

Affected: Packagist: composer/composer

### Impact

The `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.

### Patches

2.2.24 for 2.2 LTS or 2.7.7 for mainline

### Workarounds

Avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

openSUSE-SU-2024:14040-1 — php-composer2-2.7.7-1.1 on GA media

php-composer2-2.7.7-1.1 on GA media

SUSE-SU-2024:2107-1 — Security update for php-composer2

Security update for php-composer2

UBUNTU-CVE-2024-35241

Affected: Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer, Ubuntu:Pro:24.04:LTS: composer