Libgit2 Project : Security Vulnerabilities, CVEs,
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
Max CVSS
5.9
EPSS Score
0.18%
Published
2017-03-24
Updated
2017-03-28
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
Max CVSS
7.5
EPSS Score
2.20%
Published
2017-03-24
Updated
2017-03-28
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
Max CVSS
9.8
EPSS Score
1.40%
Published
2017-03-24
Updated
2017-03-28
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
Max CVSS
5.5
EPSS Score
0.57%
Published
2017-02-03
Updated
2018-10-30
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
Max CVSS
5.5
EPSS Score
0.56%
Published
2017-02-03
Updated
2018-10-30
5 vulnerabilities found