rpm package
suse/libgit2&distro=SUSE Package Hub 12 SP1
pkg:rpm/suse/libgit2&distro=SUSE%20Package%20Hub%2012%20SP1
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-10130 | Med | 5.9 | < 0.24.6-10.1 | 0.24.6-10.1 | Mar 24, 2017 | The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable. | |
| CVE-2016-10129 | Hig | 7.5 | < 0.24.6-10.1 | 0.24.6-10.1 | Mar 24, 2017 | The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line. | |
| CVE-2016-10128 | Cri | 9.8 | < 0.24.6-10.1 | 0.24.6-10.1 | Mar 24, 2017 | Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet. | |
| CVE-2016-8569 | Med | 5.5 | < 0.24.3-6.1 | 0.24.3-6.1 | Feb 3, 2017 | The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file. | |
| CVE-2016-8568 | Med | 5.5 | < 0.24.3-6.1 | 0.24.3-6.1 | Feb 3, 2017 | The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file. |
- affected < 0.24.6-10.1fixed 0.24.6-10.1
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
- affected < 0.24.6-10.1fixed 0.24.6-10.1
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
- affected < 0.24.6-10.1fixed 0.24.6-10.1
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
- affected < 0.24.3-6.1fixed 0.24.3-6.1
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- affected < 0.24.3-6.1fixed 0.24.3-6.1
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.