Описание
Security update for libgit2
This update for libgit2 fixes the several issues.
These security issues were fixed:
- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
Список пакетов
SUSE Linux Enterprise Software Development Kit 12 SP2
Ссылки
- Link for SUSE-SU-2017:0433-1
- E-Mail link for SUSE-SU-2017:0433-1
- SUSE Security Ratings
- SUSE Bug 1019036
- SUSE Bug 1019037
- SUSE CVE CVE-2016-10128 page
- SUSE CVE CVE-2016-10129 page
- SUSE CVE CVE-2016-10130 page
- SUSE CVE CVE-2017-5338 page
- SUSE CVE CVE-2017-5339 page
Описание
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
Затронутые продукты
Ссылки
- CVE-2016-10128
- SUSE Bug 1019036
Описание
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
Затронутые продукты
Ссылки
- CVE-2016-10129
- SUSE Bug 1019036
Описание
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
Затронутые продукты
Ссылки
- CVE-2016-10130
- SUSE Bug 1019037
Описание
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Затронутые продукты
Ссылки
- CVE-2017-5338
- SUSE Bug 1019037
Описание
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Затронутые продукты
Ссылки
- CVE-2017-5339
- SUSE Bug 1019037