libgit2: CVE-2016-8568 CVE-2016-8569

Debian Bug report logs - #840227
libgit2: CVE-2016-8568 CVE-2016-8569

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libgit2: CVE-2016-8568 CVE-2016-8569

Date: Sun, 09 Oct 2016 20:00:31 +0200

Source: libgit2
Version: 0.24.1-2
Severity: grave
Tags: security upstream

Hi,

the following vulnerabilities were published for libgit2.

CVE-2016-8568[0, 3]:
Read out-of-bounds in git_oid_nfmt

CVE-2016-8569[1, 4]:
DoS using a null pointer dereference in git_commit_message

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-8568
[1] https://security-tracker.debian.org/tracker/CVE-2016-8569
[2] https://marc.info/?l=oss-security&m=147594097425642&w=2
[3] https://github.com/libgit2/libgit2/issues/3936
[4] https://github.com/libgit2/libgit2/issues/3937
[5] https://github.com/libgit2/libgit2/pull/3956

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at submit@bugs.debian.org (full text, mbox, reply):

From: Russell Sim <russell.sim@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: Debian Bug Tracking System <submit@bugs.debian.org>, 840227@bugs.debian.org

Subject: Re: Bug#840227: libgit2: CVE-2016-8568 CVE-2016-8569

Date: Tue, 03 Jan 2017 17:55:31 +1100

Hi,

Sorry, I messed this up.

The fix for CVE-2016-8569 was included in the 0.24.2-1 release but the
fix for CVE-2016-8568 wasn't.

Sorry about that, I have pushed a new version to unstable that includes
the fix, the version is 0.24.5-1.  I realised the mistake when I was
reviewing some diffs before an upload yesterday.

Salvatore Bonaccorso <carnil@debian.org> writes:

> Source: libgit2
> Version: 0.24.1-2
> Severity: grave
> Tags: security upstream
>
> Hi,
>
> the following vulnerabilities were published for libgit2.
>
> CVE-2016-8568[0, 3]:
> Read out-of-bounds in git_oid_nfmt
>
> CVE-2016-8569[1, 4]:
> DoS using a null pointer dereference in git_commit_message
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2016-8568
> [1] https://security-tracker.debian.org/tracker/CVE-2016-8569
> [2] https://marc.info/?l=oss-security&m=147594097425642&w=2
> [3] https://github.com/libgit2/libgit2/issues/3936
> [4] https://github.com/libgit2/libgit2/issues/3937
> [5] https://github.com/libgit2/libgit2/pull/3956
>
> Please adjust the affected versions in the BTS as needed.
>
> Regards,
> Salvatore

-- 
Cheers,
Russell

Message #22 received at 840227@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Russell Sim <russell.sim@gmail.com>

Cc: 840227@bugs.debian.org

Subject: Re: Bug#840227: libgit2: CVE-2016-8568 CVE-2016-8569

Date: Tue, 3 Jan 2017 08:45:52 +0100

Hi Russell,

On Tue, Jan 03, 2017 at 05:55:31PM +1100, Russell Sim wrote:
> Hi,
> 
> Sorry, I messed this up.
> 
> The fix for CVE-2016-8569 was included in the 0.24.2-1 release but the
> fix for CVE-2016-8568 wasn't.
> 
> Sorry about that, I have pushed a new version to unstable that includes
> the fix, the version is 0.24.5-1.  I realised the mistake when I was
> reviewing some diffs before an upload yesterday.

Thanks. I have fixed the security-tracker information regarding those
CVEs.

Regards,
Salvatore

Message #37 received at 840227-done@bugs.debian.org (full text, mbox, reply):

From: Pirate Praveen <praveen@onenetbeyond.org>

To: 840227-done@bugs.debian.org

Subject: fixed in sid long back

Date: Wed, 18 Jul 2018 16:19:38 +0530

[Message part 1 (text/plain, inline)]

closing.

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.