Sicherheit: Denial of Service in libgit2
Aktuelle Meldungen Distributionen
Name: Denial of Service in libgit2
ID: FEDORA-2018-3e021c6c2e
Distribution: Fedora
Plattformen: Fedora 28
Datum: Do, 9. August 2018, 22:57
Referenzen: Keine Angabe
Applikationen: Git


Fedora Update Notification
2018-08-09 17:40:27.265194

Name : libgit2
Product : Fedora 28
Version : 0.26.6
Release : 1.fc28
URL : http://libgit2.github.com/
Summary : C implementation of the Git core methods as a library with a
solid API
Description :
libgit2 is a portable, pure C implementation of the Git core methods
provided as a re-entrant linkable library with a solid API, allowing
you to write native speed custom Git applications in any language
with bindings.

Update Information:

This is a security release fixing out-of-bounds reads when processing smart-
protocol "ng" packets. When parsing an "ng" packet, we keep
track of both the
current position as well as the remaining length of the packet itself. But
instead of taking care not to exceed the length, we pass the current
position to strchr, which will search for a certain character until hitting
It is thus possible to create a crafted packet which doesn't contain a NUL
to trigger an out-of-bounds read. The issue was discovered by the oss-fuzz
project, issue 9406.

* Tue Aug 7 2018 Pete Walter <pwalter@fedoraproject.org> - 0.26.6-1
- Update to 0.26.6
* Tue Jul 10 2018 Pete Walter <pwalter@fedoraproject.org> - 0.26.5-1
- Update to 0.26.5 (CVE-2018-10887, CVE-2018-10888)
* Mon Jun 25 2018 Pete Walter <pwalter@fedoraproject.org> - 0.26.4-1
- Update to 0.26.4 (CVE-2018-11235)

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-3e021c6c2e' at the command
line. For more information, refer to the dnf documentation available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAFODB7GRTYS4SCIO2GNYOE4NAC7AE3P/
Pro-Linux @Facebook
Neue Nachrichten