[voltagex_]

Ubuntu should announce the fix at https://www.ubuntu.com/usn/ but I can't load the page right now.

(removed DSA link as per advice below)

[0x0]

That Debian advisory is a different, older vulnerability. Looks like they know about it but haven't released anything yet:

https://security-tracker.debian.org/tracker/source-package/g...

[voltagex_]

Oops, thanks.

[reedloden]

https://bugs.launchpad.net/ubuntu/+source/git/+bug/1557787 is the tracking bug for this issue. Seems like it's fixed on xenial but not yet in older releases.