CVE-2016-8569

Published: Feb 3, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.

Affected (8)

Products: Libgit2 Project: Libgit2 · Fedoraproject: Fedora · Opensuse: Leap, Opensuse · +1 more

Show all products

Libgit2 Project: Libgit2 · Fedoraproject: Fedora · Opensuse: Leap, Opensuse · Suse: Linux Enterprise

1 product

1 product

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libgit2 Project Libgit2	Up to 0.24.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 23
Fedoraproject Fedora	Version 24
Fedoraproject Fedora	Version 25

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Leap	Version 42.2
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise	Version 12.0

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (24)

http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.html

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/10/08/7

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/93465

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1383211

Source: cve@mitre.org

Issue Tracking

https://github.com/libgit2/libgit2/issues/3937

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/libgit2/libgit2/releases/tag/v0.24.3

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4E77DG5KGQ7L34U75QY7O6NIPKZNQHQJ/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JBSNJAXP7JA3TGE2NPNRTD77JXFG4E/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVUEIG6EESZB6BRU2IE3F5NRUEHMAEKC/

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.html