CVE-2016-8569
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a...
CVE-2016-8569 is a medium vulnerability (CVSS 5.5) in Libgit2 Project Libgit2, published December 2, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in libgit2 0.24.3-r0.
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
CVE-2016-8569- Updated
- 2026-11-02
EUVDEUVD-2016-9417 No score
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
EUVD-2016-9417- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m99c-3xxj-4mxh
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a...
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
GHSA-m99c-3xxj-4mxh- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-8569
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
ALPINE-CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2016-8569
CVE-2016-8569 does not affect BellSoft software
- Record
BELL-CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSV
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-8569
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
DEBIAN-CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-8569
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
- Record
UBUNTU-CVE-2016-8569- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0319 No score
Updated libgit2 packages fix security vulnerabilities
Read out-of-bounds in git_oid_nfmt (CVE-2016-8568).
DoS using a null pointer dereference in git_commit_message (CVE-2016-8569).
Insufficient sanitization allows some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (CVE-2016-10128, CVE-2016-10129).
- Record
MGASA-2017-0319- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0195-1 No score
Security update for libgit2
AThis update for libgit2 fixes the following issues:
- CVE-2016-8568: invalid memory accesses parsing object files (out-of-bound read) (boo#1003810)
- CVE-2016-8569: invalid memory accesses parsing object files (NULL pointer de-reference) (boo#1003810)
- Record
openSUSE-SU-2017:0195-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10249-1 No score
libgit2-24-0.24.3-1.1 on GA media
These are all security issues fixed in the libgit2-24-0.24.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10249-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2969-1 No score
Security update for libgit2
libgit2 was updated to fix two security issues.
These security issues were fixed:
- CVE-2016-8568: Read out-of-bounds in git_oid_nfmt (bsc#1003810).
- CVE-2016-8569: DoS caused by a NULL pointer dereference in git_commit_message (bsc#1003810).
- Record
SUSE-SU-2016:2969-1- Updated
- 2026-11-02
OSVUSN-4798-1 No score
libgit2 vulnerabilities
It was discovered that libgit2 mishandled certain malformed git objects. A remote attacker could use this vulnerability to cause a denial of service.
- Record
USN-4798-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgit2Alpine:v3.10 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.11 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.5 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.6 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.7 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.8 |
before 0.24.3-r0 | 0.24.3-r0 |
libgit2Alpine:v3.9 |
before 0.24.3-r0 | 0.24.3-r0 |
cargoDebian:12 |
before 0.17.0-1 | 0.17.0-1 |
libgit2Debian:12 |
before 0.24.2-2 | 0.24.2-2 |
libgit2Debian:13 |
before 0.24.2-2 | 0.24.2-2 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgit2Debian:14 |
before 0.24.2-2 | 0.24.2-2 |
libgit2Mageia:5 |
before 0.21.1-3.2.mga5 | 0.21.1-3.2.mga5 |
libgit2SUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.24.1-3.1 | 0.24.1-3.1 |
libgit2Ubuntu:Pro:14.04:LTS |
before 0.19.0-2ubuntu0.4+esm1, plus listed versions 0.19.0-20.19.0-2ubuntu0.4 |
0.19.0-2ubuntu0.4+esm1 |
libgit2Ubuntu:Pro:16.04:LTS |
before 0.24.1-2ubuntu0.2+esm1, plus listed versions 0.22.2-20.23.1-10.24.1-20.24.1-2ubuntu0.2 |
0.24.1-2ubuntu0.2+esm1 |
libgit2SUSE:Package Hub 12 SP1 |
before 0.24.3-6.1 | 0.24.3-6.1 |
libgit2openSUSE:Tumbleweed |
before 0.24.3-1.1 | 0.24.3-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=1383211
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E
securityfocus.com/bid/93465
openwall.com/lists/oss-security/2016/10/08/7
github.com/libgit2/libgit2/issues/3937
Show 26 moreShow less
lists.opensuse.org/opensuse-updates/2016-12/msg00075.html
nvd.nist.gov/vuln/detail/CVE-2016-8569
security.alpinelinux.org/vuln/CVE-2016-8569
docs.bell-sw.com/security/cves/CVE-2016-8569
security-tracker.debian.org/tracker/CVE-2016-8569
advisories.mageia.org/MGASA-2017-0319.html
bugs.mageia.org/show_bug.cgi?id=19792
suse.com/support/update/announcement/2016/suse-su-20162969-1
bugzilla.suse.com/1003810
ubuntu.com/security/CVE-2016-8569
cve.org/CVERecord?id=CVE-2016-8569