CVE-2016-8568

The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.

The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.

The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.

Read out-of-bounds in git_oid_nfmt (CVE-2016-8568).

DoS using a null pointer dereference in git_commit_message (CVE-2016-8569).

Insufficient sanitization allows some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (CVE-2016-10128, CVE-2016-10129).

AThis update for libgit2 fixes the following issues:

• CVE-2016-8568: invalid memory accesses parsing object files (out-of-bound read) (boo#1003810)
• CVE-2016-8569: invalid memory accesses parsing object files (NULL pointer de-reference) (boo#1003810)

These are all security issues fixed in the libgit2-24-0.24.3-1.1 package on the GA media of openSUSE Tumbleweed.

libgit2 was updated to fix two security issues.

These security issues were fixed:

• CVE-2016-8568: Read out-of-bounds in git_oid_nfmt (bsc#1003810).
• CVE-2016-8569: DoS caused by a NULL pointer dereference in git_commit_message (bsc#1003810).

It was discovered that libgit2 mishandled certain malformed git objects. A remote attacker could use this vulnerability to cause a denial of service.