Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol     support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified     impact via a crafted non-flush packet. (CVE-2016-10128)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for libgit2 fixes the several issues.

These security issues were fixed :

  - CVE-2016-10128: Additional sanitization prevent some     edge cases in the Git Smart Protocol which can lead to     reading outside of a buffer (bsc#1019036).

  - CVE-2016-10129: Additional sanitization prevent some     edge cases in the Git Smart Protocol which can lead to     reading outside of a buffer (bsc#1019036).

  - CVE-2016-10130: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

  - CVE-2017-5338: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

  - CVE-2017-5339: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for libgit2 fixes the following issues :

  - CVE-2016-10130: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

  - CVE-2017-5338: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

  - CVE-2017-5339: When using the custom certificate     callback or when using pygit2 or git2go a attacker could     have caused an invalid certificate to be accepted     (bsc#1019037).

  - CVE-2016-10128: Additional sanitization prevent some     edge cases in the Git Smart Protocol which can lead to     reading outside of a buffer (bsc#1019036).

  - CVE-2016-10129: Additional sanitization prevent some     edge cases in the Git Smart Protocol which can lead to     reading outside of a buffer (bsc#1019036).

Update to 0.24.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254824	Linux Distros Unpatched Vulnerability : CVE-2016-10128	Nessus	Misc.	critical
97282	openSUSE Security Update : libgit2 (openSUSE-2017-262)	Nessus	SuSE Local Security Checks	critical
97074	openSUSE Security Update : libgit2 (openSUSE-2017-213)	Nessus	SuSE Local Security Checks	critical
96501	Fedora 24 : libgit2 (2017-403346d884)	Nessus	Fedora Local Security Checks	critical
96500	Fedora 25 : libgit2 (2017-2ddf7d452a)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-10128

critical

Tenable Plugins

critical

critical

critical

critical

critical