CVE-2016-8568
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
79.2%
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fedoraproject | fedora | 23 | cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* |
| fedoraproject | fedora | 24 | cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* |
| fedoraproject | fedora | 25 | cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:* |
| opensuse | leap | 42.1 | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
| opensuse | leap | 42.2 | cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.2 | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
| suse | linux_enterprise | 12.0 | cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* |
| libgit2_project | libgit2 | * | cpe:2.3:a:libgit2_project:libgit2:*:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-updates/2016-12/msg00075.html
lists.opensuse.org/opensuse-updates/2017-01/msg00103.html
lists.opensuse.org/opensuse-updates/2017-01/msg00110.html
lists.opensuse.org/opensuse-updates/2017-01/msg00114.html
www.openwall.com/lists/oss-security/2016/10/08/7
www.securityfocus.com/bid/93466
bugzilla.redhat.com/show_bug.cgi?id=1383211
github.com/libgit2/libgit2/issues/3936
github.com/libgit2/libgit2/releases/tag/v0.24.3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
79.2%