CVE-2016-10129 The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
HighCVSS 7.5
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cargo(Debian:12) | < 0.17.0-1 | 0.17.0-1 |
| debian/libgit2(Debian:12) | < 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
| debian/libgit2(Debian:13) | < 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
| debian/libgit2(Debian:14) | < 0.25.1+really0.24.6-1 | 0.25.1+really0.24.6-1 |
| libgit2 project libgit2 | <= 0.24.5 | No fix listed |
| libgit2 project libgit2 | = 0.25.0 | No fix listed |
| libgit2 project libgit2 | = 0.25.0-rc1 | No fix listed |
| libgit2 project libgit2 | = 0.25.0-rc2 | No fix listed |
| alpine/libgit2(Alpine:v3.10) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.11) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.12) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.13) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.14) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.15) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.16) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.17) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.18) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.19) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.20) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.21) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.22) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.23) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.24) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.4) | < 0.24.6-r0 | 0.24.6-r0 |
| alpine/libgit2(Alpine:v3.5) | < 0.24.6-r0 | 0.24.6-r0 |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libgit2(Alpine:v3.6) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.7) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.8) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2(Alpine:v3.9) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2-0.27(Alpine:v3.10) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2-1.0(Alpine:v3.13) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2-1.0(Alpine:v3.14) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2-1.1(Alpine:v3.15) | < 0.25.1-r0 | 0.25.1-r0 |
| alpine/libgit2-1.1(Alpine:v3.16) | < 0.25.1-r0 | 0.25.1-r0 |
References
- Debian Security Tracker CVE-2016-10129 vendor-advisory
- openSUSE-SU-2017:0397 third-party-advisory vendor-advisory
- openSUSE-SU-2017:0405 third-party-advisory vendor-advisory
- openSUSE-SU-2017:0484 third-party-advisory vendor-advisory
- [oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6 mailing-list patch third-party-advisory
- [oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6 mailing-list patch third-party-advisory
- 95339 vdb-entry
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- libgit2.github.com patch vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking