VulnerabilityModified
CVE-2016-8568
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
MEDIUM 5.5EPSS 1.90%
Does this matter?
Lower severity and a low EPSS score (1.90%). Track it; it rarely justifies an emergency change on its own.
Description
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.90% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- fedoraproject/fedora · opensuse/leap · opensuse/opensuse · suse/linux enterprise · libgit2 project/libgit2
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/10/08/7Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/93466Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1383211Issue Tracking
- https://github.com/libgit2/libgit2/issues/3936Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.24.3Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/10/08/7Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/93466Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1383211Issue Tracking
- https://github.com/libgit2/libgit2/issues/3936Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgit2/libgit2/releases/tag/v0.24.3Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.