Apple has released a new version of its Xcode development tool in order to patch two critical vulnerabilities in the Git source code management client.
The Git vulnerabilities, CVE‑2016‑2324 and CVE‑2016‑2315, have been known since mid-March and can be exploited when cloning a repository with a specially crafted file structure. This allows attackers to execute malicious code on systems where such cloning operations were initiated.
Xcode is an integrated development environment (IDE) used by a large number of developers to write applications for OS X and iOS. It includes a package called the OS X Command Line Tools for Xcode that contains the open-source Git client.
The version of Git shipped with the command line tools package has now been updated to 2.7.4. This version was released by the Git developers on March 17, but it took Apple a month and a half to integrate into Xcode.
Some systems administrators criticized Apple last month for dragging its feet on importing the upstream patches for such serious flaws. In the absence of a fix, they had to resort to hackery in order to disable Git on Macs in their organizations, potentially breaking workflows.
The Command Line Tools package is not installed by default on OS X, but users can install it separately from Xcode itself. Systems who have it installed should receive an update notification through the Mac App Store.