id: PYSEC-2017-74
details: The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users
  to execute arbitrary code via a crafted repo with a malicious git log in the current
  working directory.
affected:
- package:
    name: tqdm
    ecosystem: PyPI
    purl: pkg:pypi/tqdm
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.11.2
  versions:
  - "1.0"
  - 2.0.0
  - 2.0.0.dev0
  - 2.2.3
  - 2.2.4
  - 3.1.3
  - 3.1.4
  - 3.4.0
  - 3.7.0
  - 3.7.1
  - 3.8.0
  - 4.1.0
  - 4.10.0
  - 4.11.0
  - 4.11.1
  - 4.4.0
  - 4.4.1
  - 4.4.3
  - 4.5.0
  - 4.5.2
  - 4.6.1
  - 4.6.2
  - 4.7.0
  - 4.7.1
  - 4.7.2
  - 4.7.4
  - 4.7.6
  - 4.8.1
  - 4.8.2
  - 4.8.3
  - 4.8.4
  - 4.9.0
references:
- type: REPORT
  url: https://github.com/tqdm/tqdm/issues/328
- type: WEB
  url: http://www.securityfocus.com/bid/95143
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/12/28/8
- type: ADVISORY
  url: https://security.gentoo.org/glsa/201807-01
- type: ADVISORY
  url: https://github.com/advisories/GHSA-r7q7-xcjw-qx8q
aliases:
- CVE-2016-10075
- GHSA-r7q7-xcjw-qx8q
modified: "2021-07-25T23:34:56.013301Z"
published: "2017-01-19T20:59:00Z"