Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:0397-1

Опубликовано: 06 фев. 2017
Источник: suse-cvrf

Описание

Security update for libgit2

This update for libgit2 fixes the following issues:

  • CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
  • CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).

Список пакетов

openSUSE Leap 42.1
libgit2-0.22.1-8.1
libgit2-22-0.22.1-8.1
libgit2-22-32bit-0.22.1-8.1
libgit2-devel-0.22.1-8.1

Описание

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.


Затронутые продукты
openSUSE Leap 42.1:libgit2-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-32bit-0.22.1-8.1
openSUSE Leap 42.1:libgit2-devel-0.22.1-8.1

Ссылки

Описание

The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.


Затронутые продукты
openSUSE Leap 42.1:libgit2-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-32bit-0.22.1-8.1
openSUSE Leap 42.1:libgit2-devel-0.22.1-8.1

Ссылки

Описание

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.


Затронутые продукты
openSUSE Leap 42.1:libgit2-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-32bit-0.22.1-8.1
openSUSE Leap 42.1:libgit2-devel-0.22.1-8.1

Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.


Затронутые продукты
openSUSE Leap 42.1:libgit2-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-32bit-0.22.1-8.1
openSUSE Leap 42.1:libgit2-devel-0.22.1-8.1

Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.


Затронутые продукты
openSUSE Leap 42.1:libgit2-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-0.22.1-8.1
openSUSE Leap 42.1:libgit2-22-32bit-0.22.1-8.1
openSUSE Leap 42.1:libgit2-devel-0.22.1-8.1

Ссылки