FKIE_CVE-2016-10129

Vulnerability from fkie_nvd - Published: 2017-03-24 15:59 - Updated: 2026-06-17 00:39
Severity
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
References
security@debian.orghttp://lists.opensuse.org/opensuse-updates/2017-02/msg00030.htmlThird Party Advisory
security@debian.orghttp://lists.opensuse.org/opensuse-updates/2017-02/msg00036.htmlThird Party Advisory
security@debian.orghttp://lists.opensuse.org/opensuse-updates/2017-02/msg00072.htmlThird Party Advisory
security@debian.orghttp://www.openwall.com/lists/oss-security/2017/01/10/5Mailing List, Patch, Third Party Advisory
security@debian.orghttp://www.openwall.com/lists/oss-security/2017/01/11/6Mailing List, Patch, Third Party Advisory
security@debian.orghttp://www.securityfocus.com/bid/95339
security@debian.orghttps://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11aIssue Tracking, Patch, Third Party Advisory
security@debian.orghttps://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037Issue Tracking, Patch, Third Party Advisory
security@debian.orghttps://libgit2.github.com/security/Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2017/01/10/5Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2017/01/11/6Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/95339
af854a3a-2127-422b-91ae-364da2661108https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11aIssue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://libgit2.github.com/security/Patch, Vendor Advisory
Impacted products
Vendor Product Version
libgit2_project libgit2 *
libgit2_project libgit2 0.25.0
libgit2_project libgit2 0.25.0
libgit2_project libgit2 0.25.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "security@debian.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libgit2_project:libgit2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6747DEC6-17F3-45F9-B98B-5161469D89F7",
              "versionEndIncluding": "0.24.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "157A6552-8A3B-42B7-8BA3-24B03BD7812E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "EB081C3A-79B4-48A9-B6C2-46641293244B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:libgit2_project:libgit2:0.25.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "D0A1B2E8-B0EC-41B9-A8B2-DD6A0A8DF14C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line."
    },
    {
      "lang": "es",
      "value": "El soporte Git Smart Protocol en libgit2 en versiones anteriores a 0.24.6 y 0.25.x en versiones anteriores a 0.25.1 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (referencia a puntero NULL) a trav\u00e9s de una linea de paquete vac\u00eda."
    }
  ],
  "id": "CVE-2016-10129",
  "lastModified": "2026-06-17T00:39:06.780",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-03-24T15:59:00.230",
  "references": [
    {
      "source": "security@debian.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2017/01/10/5"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2017/01/11/6"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.securityfocus.com/bid/95339"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://libgit2.github.com/security/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2017/01/10/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2017/01/11/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/95339"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://libgit2.github.com/security/"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.