Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:0484-1

Опубликовано: 16 фев. 2017
Источник: suse-cvrf

Описание

Security update for libgit2

This update for libgit2 fixes the several issues.

These security issues were fixed:

  • CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
  • CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).
  • CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).
  • CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Список пакетов

openSUSE Leap 42.2
libgit2-0.24.1-6.1
libgit2-24-0.24.1-6.1
libgit2-24-32bit-0.24.1-6.1
libgit2-devel-0.24.1-6.1

Описание

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.


Затронутые продукты
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1

Ссылки

Описание

The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.


Затронутые продукты
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1

Ссылки

Описание

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.


Затронутые продукты
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1

Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.


Затронутые продукты
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1

Ссылки

Описание

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.


Затронутые продукты
openSUSE Leap 42.2:libgit2-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-0.24.1-6.1
openSUSE Leap 42.2:libgit2-24-32bit-0.24.1-6.1
openSUSE Leap 42.2:libgit2-devel-0.24.1-6.1

Ссылки