Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

suse-cvrf Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

openSUSE-SU-2017:0484-1

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 16 Ρ„Π΅Π². 2017
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: suse-cvrf

ОписаниС

Security update for libgit2

This update for libgit2 fixes the several issues.

These security issues were fixed:

  • CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
  • CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
  • CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Бписок ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ²

openSUSE Leap 42.2
libgit2-0.24.1-6.1
libgit2-24-0.24.1-6.1
libgit2-24-32bit-0.24.1-6.1
libgit2-devel-0.24.1-6.1

Бсылки

ОписаниС

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1
Бсылки

ОписаниС

The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1
Бсылки

ОписаниС

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1
Бсылки

ОписаниС

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1
Бсылки

ОписаниС

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1
Бсылки
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ openSUSE-SU-2017:0484-1