These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in libgit2, a portable C implementation of the Git core methods, can cause a heap out-of-bounds walk, potentially crashing a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5. The vulnerability arises from a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without verifying the s [truncated]
libgit2 is vulnerable to a denial-of-service attack due to a memory exhaustion issue. The git_delta_apply function in delta.c does not properly validate the res_sz value from a delta object header, leading to large allocations and potential memory exhaustion. This issue is fixed in versions 1.8.6 and 1.9.5. Affected systems and applications using libgit2 should be assessed for exposure, and patching or up [truncated]
libgit2, a portable C implementation of Git core methods, is vulnerable to a path traversal issue. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue allows attackers to create directories outside the repository working tree, potentially leading to security risks. Defenders [truncated]
A vulnerability in libgit2, a portable C implementation of the Git core methods, allows a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. This issue is fixed in versions 1.8.6 and 1.9.5. The vulnerability is caused by an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certif [truncated]