CVE-2016-10075

Advisory

The tqdm._version module in tqdm versions before 4.11.2 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- thread safety 332
- address `DeprecationWarning` 319 -> 326
- version extra 328 -> 330
- security fix
- add non-master branch name
- minor safety
- minor documentation and comments

Resources

• https://pypi.org/project/tqdm
• https://pyup.io/changelogs/tqdm/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10075
• https://github.com/tqdm/tqdm/issues/328
• http://www.securityfocus.com/bid/95143
• http://www.openwall.com/lists/oss-security/2016/12/28/8
• https://security.gentoo.org/glsa/201807-01