PT-2017-7754 · Libgit2+2 · Libgit2+2

Andreas Stieger · Published 2017-01-12 · Updated 2017-08-29 · CVE-2016-10129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 0.24.6 libgit2 versions 0.25.x prior to 0.25.1

Description The issue allows remote attackers to cause a denial of service due to a NULL pointer dereference via an empty packet line in the Git Smart Protocol support.

Recommendations For versions prior to 0.24.6, update to version 0.24.6 or later. For versions 0.25.x prior to 0.25.1, update to version 0.25.1 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-1036

CVE-2016-10129

MGASA-2017-0319

OPENSUSE-SU-2017:0405-1

SUSE-SU-2017:0433-1

Affected Products

Alt Linux

Suse

Libgit2

References · 38

• https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037 · Patch
• https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a · Patch
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10129 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10130 · Security Note
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0433-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/01/10/5 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10129 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-10129 · Security Note
• https://advisories.mageia.org/MGASA-2017-0319.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10129 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0319 · Vendor Advisory