diff options
| author | Matthias Fechner <mfechner@FreeBSD.org> | 2019-08-18 09:28:32 +0000 |
|---|---|---|
| committer | Matthias Fechner <mfechner@FreeBSD.org> | 2019-08-18 09:28:32 +0000 |
| commit | 85b8292e9ba19738b70e424bc307b721ff5c18b7 (patch) | |
| tree | c4a1bcdb74534f430c31d8219ca49bf5f6914cce | |
| parent | - Update WWW (diff) | |
Document libgit2 vulnerabilities.
Notes
Notes:
svn path=/head/; revision=509192
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 25a0f393b171..db5998c3e631 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,38 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="d51b52cf-c199-11e9-b13f-001b217b3468"> + <topic>Libgit2 -- multiple vulnerabilities</topic> + <affects> + <package> + <name>libgit2</name> + <range><lt>0.28.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Git community reports:</p> + <blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.28.3"> + <p>A carefully constructed commit object with a very large number +of parents may lead to potential out-of-bounds writes or +potential denial of service.</p> + <p>The ProgramData configuration file is always read for compatibility +with Git for Windows and Portable Git installations. The ProgramData +location is not necessarily writable only by administrators, so we +now ensure that the configuration file is owned by the administrator +or the current user.</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/libgit2/libgit2/releases/tag/v0.28.3</url> + </references> + <dates> + <discovery>2019-08-13</discovery> + <entry>2019-08-18</entry> + </dates> + </vuln> + <vuln vid="caf545f2-c0d9-11e9-9051-4c72b94353b5"> <topic>Apache -- Multiple vulnerabilities</topic> <affects> |