CVE-2016-8568

NameCVE-2016-8568
DescriptionThe git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs840227, 860989

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cargo (PTS)buster0.43.1-3~deb10u1fixed
bullseye0.47.0-3fixed
bookworm0.66.0+ds1-1fixed
trixie, sid0.70.1+ds1-2fixed
libgit2 (PTS)buster0.27.7+dfsg.1-0.2fixed
buster (security)0.27.7+dfsg.1-0.2+deb10u2fixed
bullseye1.1.0+dfsg.1-4+deb11u1fixed
bullseye (security)1.1.0+dfsg.1-4+deb11u2fixed
bookworm1.5.1+ds-1fixed
bookworm (security)1.5.1+ds-1+deb12u1fixed
trixie, sid1.7.2+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cargosourceexperimental0.17.0-1~exp1
cargosource(unstable)0.17.0-1860989
libgit2source(unstable)0.24.5-1840227

Notes

[jessie] - libgit2 <no-dsa> (Minor issue)
https://github.com/libgit2/libgit2/issues/3936

Search for package or bug name: Reporting problems