CVE-2016-1900

CVE-2016-1900 affects CGit prior to 0.12. The vulnerability arises from CRLF/header injection in cgit_print_http_headers (ui-shared.c), enabling a remote attacker with write-access to a repository to inject arbitrary HTTP headers and trigger HTTP response splitting and potential XSS via newline c...

CVE-2016-1899

CVE-2016-1899, -1900, -1901 affect cgit prior to the fixes (0.12.x line). Exploitable via CRLF/header injection, cross-site scripting and an integer/buffer overflow in the mime/filename handling, as detailed by multiple advisories. Debian shows fixed versions: Jessie (0.10.2.git2.0.1-3+deb8u1) an...